<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="827">
<package pkgid="ba8907f01cdcca595a526ceb39b2b552f33b3ba0287e3c857eee1e3f89e4a878" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="486fa547d1dfcd27525ab2e010f7620b441f05552585c704c160b6bc1a5ab750" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="6a0c103602f3da361ee087fe464ea13c832c1001b2a8ae02b01502aeab7a6f25" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="0685bdbb91ab26b934a48b0e68a1add4e172a16549ecc79512d7905a29f60977" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="14fc3faacc829b417654d075a2d8b98896202c25ef647d559bb4accd5e91174d" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="5acefacb28b0228d26c351bbb22f55ade663c1c222afc6aed1ee25c934d5123e" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="81ae04a9bef9277dd12552ab14a6ff66f47fc390848c1dc5e9d9d5ac89ee622f" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="d7084fd1e22eaca9cb364ff17a8cda0075c250353c722044ef8fe66c8e42415a" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="786bb8d768283fbc08e945b1f4ce456bb23c748260fea5c04ba703fd149fb8c8" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="e97c092c9258b8fb7efa0ea42c3aea81a30b0b909db6da8e974e8f2d3f90225b" name="ImageMagick-config-7-upstream" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="a153c32f4b559bd10050623f4604e908d1642c40b1f2ed258420dd70003fa47b" name="ImageMagick-config-7-upstream" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="b72e0e3c97d956ae85185a63e064fd461b49994bf3f89bb18474629b77e60179" name="ImageMagick-config-7-upstream" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="cfa95f0ae5f93ec21e1811ad24eb187b5dc84a29dab98bb19018d0c4d3070558" name="ImageMagick-config-7-upstream" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="71b657ff9ca71eaf136c1d140d728fea74b3f822114018204aad7964e13dfc83" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="640392b0b5b3158128ffba478f9216b94486f0d5f0a343f7046ab40318285d4d" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="f06e731b0781fbec3b3d9079989c80d8fab3e2d94e94bdc12c12f4005603dde2" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="8738edd19cca0877d8bad543804ff5890445d56caf6cfdf32c5bdb46f234e9dd" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="f9cba107f36c222e571c4dc472c978781d74d8d9c4e140cd91a20b04423c6e81" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="29c13e89371e218db533ebdaf963eda2a42bdac25e4f63c07d03ea79b3905cc1" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="a753076793e88773dbfe79394c964e51f87367d8b6414962af58b0a6fa1b72da" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="847610414d1717f7b640cbf23fb8d904c0c15f0604b322025eb92e2315832430" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="2c719d796abe6d575a2d07c4eec6c53ee596c886712d8393d915410d828a856d" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="684b2d804af4de52616893d48121629c4ef01ad047316e47140ba0e57697e8e6" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="e650172f967f562a3fae4ec826cb58e14c2a0e94bb7ce669675c6d32bb6f65df" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="2853325f65c7625fe32ff857acd19adc790bf5a0eb2be469a866c39e557027b3" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="c800fbaafc651735011edd6a7ef5a0df8927a69339766feff6a511debe148c14" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="94a8faf168f5b02bcaf7d83ba832c42ebc0c8de01709f5d5c2e1da02a00e8d23" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="b50228f63691b44276eb5224d2dcdd976e5435c281b5d0f93d6259ef1be680c7" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="d58bb662f9371f62b5a1def1975060a0cf547499872581f22069fa505be9c763" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="cc17068a3d15c654f79f9c113c1b2a360c0445961b5c8d6062e1e188ffa76ce5" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="15de9d1138150b081aad2cf5b993bf61e55700198d02212487362daad30de0f6" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="a2f85bc9354531b29daa781d516dc35bc6ea4720cd952810deb4ee1cddb0b279" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="bb76eaefdb413468067d7f3ca56cd98b1e57fc2b2b41b6057ee30f83b48763af" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="7a38525cff3347313f6b7a1f3c4ff4d522e8f7994372666cebde6dfa1de2ff6f" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="3503a54c9766340145da2d5b5e53a0ea96fb2a343247e6ff890749aeca87bd44" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="1f487246274eae67d89aa9bc39b6dc033c3bd516a014919346ad661cd11edbf0" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="f6dac9f631c92d39e33de6a27ae964d510d5b282b972f053ec4fce2a8ad54017" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="b6f1c5fbb47511a1e8ae2f2e66efb68707873697270e336a5b8ba0809f4051e5" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="dfd6a3dfebf438e1772d66da767f8e90d0f55afd5f20bd349e09bc03931b857c" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="7d3e608135db1e558a22dfa9fb796a9078e0fb9ff9c70de1f6483f1195ab2c09" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="98d3464236e8d9960c102876a723ffa298073eb3ef71c69b6745db10294286c2" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="cd611c878b498775c87a2a9b90cbcfee99a537edc034474e00cad172495bf0d5" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="c5c0a5edd1a03453d45eb1cf0d1fd61389cf70ef532001e24fcce60045b7e82b" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="e3a9e5c6e7094ebe6e4a2571d14beee03fc6d0528c40b51172602bcac2f7cf87" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="102.12.0" rel="150200.152.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1647518400">- Add cpu-flag `asimdrdm` to aarch64 constraints, to select newer,
  faster buildhosts, as the others struggle to build FF.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648641600">- Adjust rust dependency for SP3 and later. TW uses always the
  newest version of rust, but we don't, so we can't use the
  rust+cargo notation, which would need both &lt; and &gt;= requirements.
  (bsc#1197698)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1649160000">- Firefox Extended Support Release 91.8.0 ESR
  MFSA 2022-14 (bsc#1197903)
  * CVE-2022-1097 (bmo#1745667)
    Use-after-free in NSSToken objects
  * CVE-2022-28281 (bmo#1755621)
    Out of bounds write due to unexpected WebAuthN Extensions
  * CVE-2022-1196 (bmo#1750679)
    Use-after-free after VR Process destruction
  * CVE-2022-28282 (bmo#1751609)
    Use-after-free in DocumentL10n::TranslateDocument
  * CVE-2022-28285 (bmo#1756957)
    Incorrect AliasSet used in JIT Codegen
  * CVE-2022-28286 (bmo#1735265)
    iframe contents could be rendered outside the border
  * CVE-2022-24713 (bmo#1758509)
    Denial of Service via complex regular expressions
  * CVE-2022-28289 (bmo#1663508, bmo#1744525, bmo#1753508,
    bmo#1757476, bmo#1757805, bmo#1758549, bmo#1758776)
    Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1651060800">- Firefox Extended Support Release 91.9.0 ESR
  MFSA 2022-17 (bsc#1198970)
  * CVE-2022-29914 (bmo#1746448)
    Fullscreen notification bypass using popups
  * CVE-2022-29909 (bmo#1755081)
    Bypassing permission prompt in nested browsing contexts
  * CVE-2022-29916 (bmo#1760674)
    Leaking browser history with CSS variables
  * CVE-2022-29911 (bmo#1761981)
    iframe Sandbox bypass
  * CVE-2022-29912 (bmo#1692655)
    Reader mode bypassed SameSite cookies
  * CVE-2022-29917 (bmo#1684739, bmo#1706441, bmo#1753298,
    bmo#1762614, bmo#1762620, bmo#1764778)
    Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653048000">- Firefox Extended Support Release 91.9.1 ESR
  * Fixed: Security fix
  MFSA 2022-19 (bsc#1199768)
  * CVE-2022-1802 (bmo#1770137)
    Prototype pollution in Top-Level Await implementation
  * CVE-2022-1529 (bmo#1770048)
    Untrusted input used in JavaScript object indexing, leading
    to prototype pollution</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1653912000">- Firefox Extended Support Release 91.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-21 (bsc#1200027)
  * CVE-2022-31736 (bmo#1735923)
    Cross-Origin resource's length leaked
  * CVE-2022-31737 (bmo#1743767)
    Heap buffer overflow in WebGL
  * CVE-2022-31738 (bmo#1756388)
    Browser window spoof using fullscreen mode
  * CVE-2022-31739 (bmo#1765049)
    Attacker-influenced path traversal when saving downloaded
    files
  * CVE-2022-31740 (bmo#1766806)
    Register allocation problem in WASM on arm64
  * CVE-2022-31741 (bmo#1767590)
    Uninitialized variable leads to invalid memory read
  * CVE-2022-31742 (bmo#1730434)
    Querying a WebAuthn token with a large number of
    allowCredential entries may have leaked cross-origin
    information
  * CVE-2022-31747 (bmo#1760765, bmo#1765610, bmo#1766283,
    bmo#1767365, bmo#1768559, bmo#1768734)
    Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1655899200">- Firefox Extended Support Release 91.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-25 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34481 (bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-31744 (bmo#1757604)
    CSP bypass enabling stylesheet injection
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1658404800">- Firefox Extended Support Release 91.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-29 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters</changelog>
  <changelog author="cgrobertson@suse.com" date="1661256000">- Firefox Extended Support Release 91.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-35 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- Firefox 102.2.0esr ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-34 (bsc#1202645)
  * CVE-2022-38472 (bmo#1769155)
    Address bar spoofing via XSLT error handling
  * CVE-2022-38473 (bmo#1771685)
    Cross-origin XSLT Documents would have inherited the parent's
    permissions
  * CVE-2022-38476 (bmo#1760998)
    Data race and potential use-after-free in PK11_ChangePW
  * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,
    bmo#1773363)
    Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  * CVE-2022-38478 (bmo#1770630, bmo#1776658)
    Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,
    and Firefox ESR 91.13
- Add mozilla-bmo1775202.patch to fix build on ppc64le
- Firefox Extended Support Release 102.1 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-30 (bsc#1201758)
  * CVE-2022-36319 (bmo#1737722)
    Mouse Position spoofing with CSS transforms
  * CVE-2022-36318 (bmo#1771774)
    Directory indexes for bundled resources reflected URL
    parameters
  * CVE-2022-36314 (bmo#1773894)
    Opening local &lt;code&gt;.lnk&lt;/code&gt; files could cause unexpected
    network loads
  * CVE-2022-2505 (bmo#1769739, bmo#1772824)
    Memory safety bugs fixed in Firefox 103 and 102.1
- Firefox Extended Support Release 102.0.1 ESR
  * Fixed: Fixed bookmark shortcut creation by dragging to
    Windows File Explorer and dropping partially broken
    (bmo#1774683)
  * Fixed: Fixed bookmarks sidebar flashing white when opened in
    dark mode (bmo#1776157)
  * Fixed: Fixed multilingual spell checking not working with
    content in both English and a non-Latin alphabet
    (bmo#1773802)
  * Fixed: Developer tools:  Fixed an issue where the console
    output keep getting scrolled to the bottom when the last
    visible message is an evaluation result (bmo#1776262)
  * Fixed: Fixed *Delete cookies and site data when Firefox is
    closed* checkbox getting disabled on startup (bmo#1777419)
  * Fixed: Various stability fixes
- Firefox 102.0 ESR
  * New:
  - We now provide more secure connections: Firefox can
    now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc
    headers.
  - For added viewing pleasure, full-range color levels are now
    supported for video playback on many systems.
  - Find it easier now! Mac users can now access the macOS
    share options from the Firefox File menu.
  - Voilà! Support for images containing ICC v4 profiles is
    enabled on macOS.
  - Firefox now supports the new AVIF image format, which is
    based on the modern and royalty-free AV1 video codec. It
    offers significant bandwidth savings for sites compared to
    existing image formats. It also supports transparency and
    other advanced features.
  - Firefox PDF viewer now supports filling more forms (e.g.,
    XFA-based forms, used by multiple governments and banks).
    Learn more.
  - When available system memory is critically low, Firefox on
    Windows will automatically unload tabs based on their last
    access time, memory usage, and other attributes. This helps
    to reduce Firefox out-of-memory crashes. Forgot something?
    Switching to an unloaded tab automatically reloads it.
  - To prevent session loss for macOS users who are running
    Firefox from a mounted .dmg file, they’ll now be prompted to
    finish installation. Bear in mind, this permission prompt
    only appears the first time these users run Firefox on their
    computer.
  - For your safety, Firefox now blocks downloads that rely on
    insecure connections, protecting against potentially
    malicious or unsafe downloads. Learn more and see where to
    find downloads in Firefox.
  - Improved web compatibility for privacy protections with
    SmartBlock 3.0: In Private Browsing and Strict Tracking
    Protection, Firefox goes to great lengths to protect your web
    browsing activity from trackers. As part of this, the built-
    in content blocking will automatically block third-party
    scripts, images, and other content from being loaded from
    cross-site tracking companies reported by Disconnect. Learn
    more.
  - Introducing a new referrer tracking protection in Strict
    Tracking Protection and Private Browsing. This feature
    prevents sites from unknowingly leaking private information
    to trackers. Learn more.
  - Introducing Firefox Suggest, a feature that provides
    website suggestions as you type into the address bar. Learn
    more about this faster way to navigate the web and locale-
    specific features.
  - Firefox macOS now uses Apple's low-power mode for
    fullscreen video on sites such as YouTube and Twitch. This
    meaningfully extends battery life in long viewing sessions.
    Now your kids can find out what the fox says on a loop
    without you ever missing a beat…
  - With this release, power users can use about:unloads to
    release system resources by manually unloading tabs without
    closing them.
  - On Windows, there will now be fewer interruptions because
    Firefox won’t prompt you for updates. Instead, a background
    agent will download and install updates even if Firefox is
    closed.
  - On Linux, we’ve improved WebGL performance and reduced
    power consumption for many users.
  - To better protect all Firefox users against side-channel
    attacks, such as Spectre, we introduced Site Isolation.
  - Firefox no longer warns you by default when you exit the
    browser or close a window using a menu, button, or three-key
    command. This should cut back on unwelcome notifications,
    which is always nice—however, if you prefer a bit of notice,
    you’ll still have full control over the quit/close modal
    behavior. All warnings can be managed within Firefox
    Settings. No worries! More details here.
  - Firefox supports the new Snap Layouts menus when running on
    Windows 11.
  - RLBox—a new technology that hardens Firefox against
    potential security vulnerabilities in third-party
    libraries—is now enabled on all platforms.
  - We’ve reduced CPU usage on macOS in Firefox and
    WindowServer during event processing.
  - We’ve also reduced the power usage of software decoded
    video on macOS, especially in fullscreen. This includes
    streaming sites such as Netflix and Amazon Prime Video.
  - You can now move the Picture-in-Picture toggle button to
    the opposite side of the video. Simply look for the new
    context menu option Move Picture-in-Picture Toggle to Left
    (Right) Side.
  - We’ve made significant improvements in noise suppression
    and auto-gain-control, as well as slight improvements in
    echo-cancellation to provide you with a better overall
    experience.
  - We’ve also significantly reduced main-thread load.
  - When printing, you can now choose to print only the
    odd/even pages.
  - Firefox now supports and displays the new style of
    scrollbars on Windows 11.
  - Firefox has a new optimized download flow. Instead of
    prompting every time, files will download automatically.
    However, they can still be opened from the downloads panel
    with just one click. Easy! More information
  - Firefox no longer asks what to do for each file by default.
    You won’t be prompted to choose a helper application or save
    to disk before downloading a file unless you have changed
    your download action setting for that type of file.
  - Any files you download will be immediately saved on your
    disk. Depending on the current configuration, they’ll be
    saved in your preferred download folder, or you’ll be asked
    to select a location for each download. Windows and Linux
    users will find their downloaded files in the destination
    folder. They’ll no longer be put in the Temp folder.
  - Firefox allows users to choose from a number of built-in
    search engines to set as their default. In this release, some
    users who had previously configured a default engine might
    notice their default search engine has changed since Mozilla
    was unable to secure formal permission to continue including
    certain search engines in Firefox.
  - You can now toggle Narrate in ReaderMode with the keyboard
    shortcut "n."
  - You can find added support for search—with or without
    diacritics—in the PDF viewer.
  - The Linux sandbox has been strengthened: processes exposed
    to web content no longer have access to the X Window system
    (X11).
  - Firefox now supports credit card autofill and capture in
    Germany, France, and the United Kingdom.
  - We now support captions/subtitles display on YouTube, Prime
    Video, and Netflix videos you watch in Picture-in-Picture.
    Just turn on the subtitles on the in-page video player, and
    they will appear in PiP.
  - Picture-in-Picture now also supports video captions on
    websites that use Web Video Text Track (WebVTT) format (e.g.,
    Coursera.org, Canadian Broadcasting Corporation, and many
    more).
  - On the first run after install, Firefox detects when its
    language does not match the operating system language and
    offers the user a choice between the two languages.
  - Firefox spell checking now checks spelling in multiple
    languages. To enable additional languages, select them in the
    text field’s context menu.
  - HDR video is now supported in Firefox on Mac—starting with
    YouTube! Firefox users on macOS 11+ (with HDR-compatible
    screens) can enjoy higher-fidelity video content. No need to
    manually flip any preferences to turn HDR video support
    on—just make sure battery preferences are NOT set to
    “optimize video streaming while on battery”.
  - Hardware-accelerated AV1 video decoding is enabled on
    Windows with supported GPUs (Intel Gen 11+, AMD RDNA 2
    Excluding Navi 24, GeForce 30). Installing the AV1 Video
    Extension from the Microsoft Store may also be required.
  - Video overlay is enabled on Windows for Intel GPUs,
    reducing power usage during video playback.
  - Improved fairness between painting and handling other
    events. This noticeably improves the performance of the
    volume slider on Twitch.
  - Scrollbars on Linux and Windows 11 won't take space by
    default. On Linux, users can change this in Settings. On
    Windows, Firefox follows the system setting (System Settings
    &gt; Accessibility &gt; Visual Effects &gt; Always show scrollbars).
  - Firefox now ignores less restricted referrer
    policies—including unsafe-url, no-referrer-when-downgrade,
    and origin-when-cross-origin—for cross-site
    subresource/iframe requests to prevent privacy leaks from the
    referrer.
  - Reading is now easier with the prefers-contrast media
    query, which allows sites to detect if the user has requested
    that web content is presented with a higher (or lower)
    contrast.
  - All non-configured MIME types can now be assigned a custom
    action upon download completion.
  - Firefox now allows users to use as many microphones as they
    want, at the same time, during video conferencing. The most
    exciting benefit is that you can easily switch your
    microphones at any time (if your conferencing service
    provider enables this flexibility).
  - Print preview has been updated.
  * Fixed: Various security fixes.
  MFSA 2022-24 (bsc#1200793)
  * CVE-2022-34479 (bmo#1745595)
    A popup window could be resized in a way to overlay the
    address bar with web content
  * CVE-2022-34470 (bmo#1765951)
    Use-after-free in nsSHistory
  * CVE-2022-34468 (bmo#1768537)
    CSP sandbox header without `allow-scripts` can be bypassed
    via retargeted javascript: URI
  * CVE-2022-34482 (bmo#845880)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34483 (bmo#1335845)
    Drag and drop of malicious image could have led to malicious
    executable and potential code execution
  * CVE-2022-34476 (bmo#1387919)
    ASN.1 parser could have been tricked into accepting malformed
    ASN.1
  * CVE-2022-34481 (bmo#1483699, bmo#1497246)
    Potential integer overflow in ReplaceElementsAt
  * CVE-2022-34474 (bmo#1677138)
    Sandboxed iframes could redirect to external schemes
  * CVE-2022-34469 (bmo#1721220)
    TLS certificate errors on HSTS-protected domains could be
    bypassed by the user on Firefox for Android
  * CVE-2022-34471 (bmo#1766047)
    Compromised server could trick a browser into an addon
    downgrade
  * CVE-2022-34472 (bmo#1770123)
    Unavailable PAC file resulted in OCSP requests being blocked
  * CVE-2022-34478 (bmo#1773717)
    Microsoft protocols can be attacked if a user accepts a
    prompt
  * CVE-2022-2200 (bmo#1771381)
    Undesired attributes could be set as part of prototype
    pollution
  * CVE-2022-34480 (bmo#1454072)
    Free of uninitialized pointer in lg_init
  * CVE-2022-34477 (bmo#1731614)
    MediaError message property leaked information on cross-
    origin same-site pages
  * CVE-2022-34475 (bmo#1757210)
    HTML Sanitizer could have been bypassed via same-origin
    script via use tags
  * CVE-2022-34473 (bmo#1770888)
    HTML Sanitizer could have been bypassed via use tags
  * CVE-2022-34484 (bmo#1763634, bmo#1772651)
    Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
  * CVE-2022-34485 (bmo#1768409, bmo#1768578)
    Memory safety bugs fixed in Firefox 102
- Add patch one_swizzle_to_rule_them_all.patch to fix big endian
  platforms and remove old patches for this:
  mozilla-bmo1626236.patch, mozilla-bmo1602730.patch,
  mozilla-bmo1504834-part2.patch, mozilla-bmo1504834-part4.patch
- Rename and rebase firefox-i586-conflict-typedef-error.patch
  to mozilla-bmo531915.patch
- Remove upstreamed mozilla-sandbox-fips.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1663329600">- Firefox Extended Support Release 102.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-40 (bsc#1203477)
  * CVE-2022-3266 (bmo#1767360)
    Out of bounds read when decoding H264
  * CVE-2022-40959 (bmo#1782211)
    Bypassing FeaturePolicy restrictions on transient pages
  * CVE-2022-40960 (bmo#1787633)
    Data-race when parsing non-UTF-8 URLs in threads
  * CVE-2022-40958 (bmo#1779993)
    Bypassing Secure Context restriction for cookies with __Host
    and __Secure prefix
  * CVE-2022-40956 (bmo#1770094)
    Content-Security-Policy base-uri bypass
  * CVE-2022-40957 (bmo#1777604)
    Incoherent instruction cache when building WASM on ARM64
  * CVE-2022-40962 (bmo#1776655, bmo#1777574, bmo#1784835,
    bmo#1785109, bmo#1786502, bmo#1789440)
    Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
- Rebase mozilla-silence-no-return-type.patch to apply with fuzz=0</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666094400">- Firefox Extended Support Release 102.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-45 (bsc#1204421)
  * CVE-2022-42927 (bmo#1789128)
    Same-origin policy violation could have leaked cross-origin
    URLs
  * CVE-2022-42928 (bmo#1791520)
    Memory Corruption in JS Engine
  * CVE-2022-42929 (bmo#1789439)
    Denial of Service via window.print
  * CVE-2022-42932 (bmo#1789729, bmo#1791363, bmo#1792041)
    Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4
- Added mozilla-partial-revert-1768632.patch to fix build on i586</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1668081600">- Firefox Extended Support Release 102.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-48 (bsc#1205270)
  * CVE-2022-45403 (bmo#1762078)
    Service Workers might have learned size of cross-origin media
    files
  * CVE-2022-45404 (bmo#1790815)
    Fullscreen notification bypass
  * CVE-2022-45405 (bmo#1791314)
    Use-after-free in InputStream implementation
  * CVE-2022-45406 (bmo#1791975)
    Use-after-free of a JavaScript Realm
  * CVE-2022-45408 (bmo#1793829)
    Fullscreen notification bypass via windowName
  * CVE-2022-45409 (bmo#1796901)
    Use-after-free in Garbage Collection
  * CVE-2022-45410 (bmo#1658869)
    ServiceWorker-intercepted requests bypassed SameSite cookie
    policy
  * CVE-2022-45411 (bmo#1790311)
    Cross-Site Tracing was possible via non-standard override
    headers
  * CVE-2022-45412 (bmo#1791029)
    Symlinks may resolve to partially uninitialized buffers
  * CVE-2022-45416 (bmo#1793676)
    Keystroke Side-Channel Leakage
  * CVE-2022-45418 (bmo#1795815)
    Custom mouse cursor could have been drawn over browser UI
  * CVE-2022-45420 (bmo#1792643)
    Iframe contents could be rendered outside the iframe
  * CVE-2022-45421 (bmo#1767920, bmo#1789808, bmo#1794061)
    Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1670500800">- Firefox Extended Support Release 102.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2022-52 (bsc#1206242)
  * CVE-2022-46880 (bmo#1749292)
    Use-after-free in WebGL
  * CVE-2022-46872 (bmo#1799156)
    Arbitrary file read from a compromised content process
  * CVE-2022-46881 (bmo#1770930)
    Memory corruption in WebGL
  * CVE-2022-46874 (bmo#1746139)
    Drag and Dropped Filenames could have been truncated to
    malicious extensions
  * CVE-2022-46875 (bmo#1786188)
    Download Protections were bypassed by .atloc and .ftploc
    files on Mac OS
  * CVE-2022-46882 (bmo#1789371)
    Use-after-free in WebGL
  * CVE-2022-46878 (bmo#1782219, bmo#1797370, bmo#1797685,
    bmo#1801102, bmo#1801315, bmo#1802395)
    Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673611200">- Firefox Extended Support Release 102.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes.
  MFSA 2023-02 (bsc#1207119)
  * CVE-2022-46871 (bmo#1795697)
    libusrsctp library out of date
  * CVE-2023-23598 (bmo#1800425)
    Arbitrary file read from GTK drag and drop on Linux
  * CVE-2023-23599 (bmo#1777800)
    Malicious command could be hidden in devtools output on
    Windows
  * CVE-2023-23601 (bmo#1794268)
    URL being dragged from cross-origin iframe into same tab
    triggers navigation
  * CVE-2023-23602 (bmo#1800890)
    Content Security Policy wasn't being correctly applied to
    WebSockets in WebWorkers
  * CVE-2022-46877 (bmo#1795139)
    Fullscreen notification bypass
  * CVE-2023-23603 (bmo#1800832)
    Calls to &lt;code&gt;console.log&lt;/code&gt; allowed bypasing Content
    Security Policy via format directive
  * CVE-2023-23605 (bmo#1764921, bmo#1802690, bmo#1806974)
    Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- Firefox Extended Support Release 102.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-06 (bsc#1208144)
  * CVE-2023-25728 (bmo#1790345)
    Content security policy leak in violation reports using
    iframes
  * CVE-2023-25730 (bmo#1794622)
    Screen hijack via browser fullscreen mode
  * CVE-2023-25743 (bmo#1800203)
    Fullscreen notification not shown in Firefox Focus
  * CVE-2023-0767 (bmo#1804640)
    Arbitrary memory write via PKCS 12 in NSS
  * CVE-2023-25735 (bmo#1810711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-25737 (bmo#1811464)
    Invalid downcast in SVGUtils::SetupStrokeGeometry
  * CVE-2023-25738 (bmo#1811852)
    Printing on Windows could potentially crash Firefox with some
    device drivers
  * CVE-2023-25739 (bmo#1811939)
    Use-after-free in
    mozilla::dom::ScriptLoadContext::~ScriptLoadContext
  * CVE-2023-25729 (bmo#1792138)
    Extensions could have opened external schemes without user
    knowledge
  * CVE-2023-25732 (bmo#1804564)
    Out of bounds memory write from EncodeInputStream
  * CVE-2023-25734 (bmo#1784451, bmo#1809923, bmo#1810143,
    bmo#1812338)
    Opening local .url files could cause unexpected network loads
  * CVE-2023-25742 (bmo#1813424)
    Web Crypto ImportKey crashes tab
  * CVE-2023-25744 (bmo#1789449, bmo#1803628, bmo#1810536)
    Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
  * CVE-2023-25746 (bmo#1544127, bmo#1762368)
    Memory safety bugs fixed in Firefox ESR 102.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1678622400">- Firefox Extended Support Release 102.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-10 (bsc#1209173)
  * CVE-2023-25751 (bmo#1814899)
    Incorrect code generation during JIT compilation
  * CVE-2023-28164 (bmo#1809122)
    URL being dragged from a removed cross-origin iframe into the
    same tab triggered navigation
  * CVE-2023-28162 (bmo#1811327)
    Invalid downcast in Worklets
  * CVE-2023-25752 (bmo#1811627)
    Potential out-of-bounds when accessing throttled streams
  * CVE-2023-28163 (bmo#1817768)
    Windows Save As dialog resolved environment variables
  * CVE-2023-28176 (bmo#1808352, bmo#1811637, bmo#1815904,
    bmo#1817442, bmo#1818674)
    Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1680782400">- Firefox Extended Support Release 102.10.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-14 (bsc#1210212)
  * CVE-2023-29531 (bmo#1794292)
    Out-of-bound memory access in WebGL on macOS
  * CVE-2023-29532 (bmo#1806394)
    Mozilla Maintenance Service Write-lock bypass
  * CVE-2023-29533 (bmo#1798219, bmo#1814597)
    Fullscreen notification obscured
  * CVE-2023-1999 (bmo#1819244)
    Double-free in libwebp
  * CVE-2023-29535 (bmo#1820543)
    Potential Memory Corruption following Garbage Collector
    compaction
  * CVE-2023-29536 (bmo#1821959)
    Invalid free from JavaScript code
  * CVE-2023-29539 (bmo#1784348)
    Content-Disposition filename truncation leads to Reflected
    File Download
  * CVE-2023-29541 (bmo#1810191)
    Files with malicious extensions could have been downloaded
    unsafely on Linux
  * CVE-2023-29542 (bmo#1810793, bmo#1815062)
    Bypass of file download extension restrictions
  * CVE-2023-29545 (bmo#1823077)
    Windows Save As dialog resolved environment variables
  * CVE-2023-1945 (bmo#1777588)
    Memory Corruption in Safe Browsing Code
  * CVE-2023-29548 (bmo#1822754)
    Incorrect optimization result on ARM64
  * CVE-2023-29550 (bmo#1720594, bmo#1751945, bmo#1812498,
    bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493,
    bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413,
    bmo#1824828)
    Memory safety bugs fixed in Firefox 112 and Firefox ESR
    102.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1683547200">- Firefox Extended Support Release 102.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-17 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Firefox 113 and Firefox ESR
    102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  Placeholder changelog-entry (bsc#1211922)
- update keyring</changelog>
</package>
<package pkgid="03e0d74b98604a81e054887569cfa69bcf704b8243612863a496b8cd951b5b12" name="apache-commons-fileupload" arch="noarch">
  <version epoch="0" ver="1.5" rel="150200.3.9.1"/>
  <changelog author="tchvatal@suse.com" date="1396440000">- Fix bnc#862781/CVE-2014-0050: buffer overflow
  http://svn.apache.org/viewvc?view=revision&amp;revision=1565143
  * jakarta-commons-fileupload-CVE-2014-0050-DOS-buffer-overflow.patch</changelog>
  <changelog author="darin@darins.net" date="1400155200">- disable bytecode check on sle_11
- remove removal of buildroot in %install</changelog>
  <changelog author="jmatejek@suse.com" date="1403870400">- added Xerces xml-apis to dependencies to fix build</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Cleanup with spec-cleaner and fix build on sle11 properly.</changelog>
  <changelog author="tchvatal@suse.com" date="1404820801">- Not needed condition.</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Clean spec file and fix rpmlint warnings</changelog>
  <changelog author="fstrba@suse.com" date="1544184000">- Build against xml-commons-apis instead of xerces-j2-xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Rename to apache-commons-fileupload and upgrade to version 1.4
- Generate and customize ant build.xml file</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Upgrade to upstream version 1.5
  * New features:
    + Add a configurable limit (disabled by default) for the number
    of files to upload per request (bsc#1208513, CVE-2023-24998).
    The new configuration option (FileUploadBase#setFileCountMax)
    is not enabled by default and must be explicitly configured.
  * Fixed Bugs:
    + FILEUPLOAD-293: DiskFileItem.write(File) had been changed to
    use FileUtils.moveFile internally, preventing an existing file
    as the target.
    + Improve parsing speed.
  * Changes:
    + Bump Commons IO to 2.11.0
    + FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco
    code coverage.
    + Bump JUnit to 4.13.2</changelog>
</package>
<package pkgid="a97e94eab5d2bd51bc42590f34357e84afd0a4b6adcce5151448779bed5c60fa" name="apache-commons-fileupload" arch="src">
  <version epoch="0" ver="1.5" rel="150200.3.9.1"/>
  <changelog author="skh@suse.de" date="1094385600">- Initial package created with version 1.0 (JPackage 1.5)</changelog>
  <changelog author="skh@suse.de" date="1095336000">- Fix prerequires of javadoc subpackage</changelog>
  <changelog author="dmueller@suse.de" date="1127908800">- add norootforbuild</changelog>
  <changelog author="jsmeix@suse.de" date="1129636800">- Current version 1.0 from JPackage.org</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="skh@suse.de" date="1158926400">- don't use icecream
- use target="1.4" for build with java 1.5</changelog>
  <changelog author="mvyskocil@suse.cz" date="1205409600">- merged with jpackage 1.7
- update to 1.1.1</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="mvyskocil@suse.com" date="1382011200">- fix bnc#846174/CVE-2013-2186: null byte injection flaw
  http://svn.apache.org/viewvc?view=revision&amp;revision=1507048
  * jakarta-commons-fileupload-CVE-2013-2186.patch</changelog>
  <changelog author="mvyskocil@suse.com" date="1382097600">- remove gcj part and deprecated macros</changelog>
  <changelog author="tchvatal@suse.com" date="1396440000">- Fix bnc#862781/CVE-2014-0050: buffer overflow
  http://svn.apache.org/viewvc?view=revision&amp;revision=1565143
  * jakarta-commons-fileupload-CVE-2014-0050-DOS-buffer-overflow.patch</changelog>
  <changelog author="darin@darins.net" date="1400155200">- disable bytecode check on sle_11
- remove removal of buildroot in %install</changelog>
  <changelog author="jmatejek@suse.com" date="1403870400">- added Xerces xml-apis to dependencies to fix build</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Cleanup with spec-cleaner and fix build on sle11 properly.</changelog>
  <changelog author="tchvatal@suse.com" date="1404820801">- Not needed condition.</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Clean spec file and fix rpmlint warnings</changelog>
  <changelog author="fstrba@suse.com" date="1544184000">- Build against xml-commons-apis instead of xerces-j2-xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Rename to apache-commons-fileupload and upgrade to version 1.4
- Generate and customize ant build.xml file</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Upgrade to upstream version 1.5
  * New features:
    + Add a configurable limit (disabled by default) for the number
    of files to upload per request (bsc#1208513, CVE-2023-24998).
    The new configuration option (FileUploadBase#setFileCountMax)
    is not enabled by default and must be explicitly configured.
  * Fixed Bugs:
    + FILEUPLOAD-293: DiskFileItem.write(File) had been changed to
    use FileUtils.moveFile internally, preventing an existing file
    as the target.
    + Improve parsing speed.
  * Changes:
    + Bump Commons IO to 2.11.0
    + FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco
    code coverage.
    + Bump JUnit to 4.13.2</changelog>
</package>
<package pkgid="62b131090fba68b961a56a9c2772b7657677e480935142437a235952074638e2" name="apache-commons-fileupload-javadoc" arch="noarch">
  <version epoch="0" ver="1.5" rel="150200.3.9.1"/>
  <changelog author="tchvatal@suse.com" date="1396440000">- Fix bnc#862781/CVE-2014-0050: buffer overflow
  http://svn.apache.org/viewvc?view=revision&amp;revision=1565143
  * jakarta-commons-fileupload-CVE-2014-0050-DOS-buffer-overflow.patch</changelog>
  <changelog author="darin@darins.net" date="1400155200">- disable bytecode check on sle_11
- remove removal of buildroot in %install</changelog>
  <changelog author="jmatejek@suse.com" date="1403870400">- added Xerces xml-apis to dependencies to fix build</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Cleanup with spec-cleaner and fix build on sle11 properly.</changelog>
  <changelog author="tchvatal@suse.com" date="1404820801">- Not needed condition.</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Clean spec file and fix rpmlint warnings</changelog>
  <changelog author="fstrba@suse.com" date="1544184000">- Build against xml-commons-apis instead of xerces-j2-xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Rename to apache-commons-fileupload and upgrade to version 1.4
- Generate and customize ant build.xml file</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Upgrade to upstream version 1.5
  * New features:
    + Add a configurable limit (disabled by default) for the number
    of files to upload per request (bsc#1208513, CVE-2023-24998).
    The new configuration option (FileUploadBase#setFileCountMax)
    is not enabled by default and must be explicitly configured.
  * Fixed Bugs:
    + FILEUPLOAD-293: DiskFileItem.write(File) had been changed to
    use FileUtils.moveFile internally, preventing an existing file
    as the target.
    + Improve parsing speed.
  * Changes:
    + Bump Commons IO to 2.11.0
    + FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco
    code coverage.
    + Bump JUnit to 4.13.2</changelog>
</package>
<package pkgid="5285dde6b56c0d9cd6fd8059cd569cd0757eaec8f8e50192e0278d8329561524" name="bouncycastle" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="99270795fd24748844f7352821b76706a71bdaec6a8eaa981c5b5dcc80b0fe37" name="bouncycastle" arch="src">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="d821e4cadb1aeaa173adbf7896d7226764ac92963d39f3591f92340cb7fa3f9e" name="bouncycastle-javadoc" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="7a9f7df9f790a5bfe2d8c9b39b55e73bc6e4486f3d8731bd2e1bb4b9e33e4b6d" name="bouncycastle-jmail" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="05eea43210e406d1b69bbed5525b6fe415b48f7725427e1d21561a7be2e3f1aa" name="bouncycastle-mail" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="40ff810b4bf1be87cd150cd5903382ad5a3acfb99ab58480db28efe66d31cd7c" name="bouncycastle-pg" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="7d09ece85cae82435c1fbccb868a587732678e4e9ac1cbd0a992f3aede29b6f9" name="bouncycastle-pkix" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="6ac465d76a2a638b8fcb59dfd54933b147eae5e720c4d97a76d3e04b4e1d04c1" name="bouncycastle-tls" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="de9733c894bbb09aa0d9fedbfdb4076a93eb0b884c2b8699b5967d20fb34f604" name="bouncycastle-util" arch="noarch">
  <version epoch="0" ver="1.73" rel="150200.3.18.1"/>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1682424001">- Update to version 1.73:
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
</package>
<package pkgid="9564dd456dd073ef4321deec412458007d3eee122de6a146b51a3848ccd2cb65" name="c-ares" arch="src">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="95a26cb558574bcc86b07ff62012a3f6737f8cd67d9f6efbbcc7c9933bf57950" name="c-ares-devel" arch="aarch64">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="4d5db059011620e64b27bd5e9863baaf6de6a1b07e95a41628862438557f086c" name="c-ares-devel" arch="ppc64le">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="33facca7d2ec4f8470ff998c1bbd34f7dfa723433ceaf873e5928e6d3b4998ce" name="c-ares-devel" arch="s390x">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="80a3bf2fb8f5fbfe9219d828ce1defaa9b63f3135113e7932258f12102a09735" name="c-ares-devel" arch="x86_64">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="5c5f2455a8956815b58236cb2a572f3ca48bd0492ae5db79c3989e1bb9e71f70" name="c-ares-utils" arch="aarch64">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="e443af366f928937747520885d7a4af7db5e1a528085f3cc5510e52081537435" name="c-ares-utils" arch="ppc64le">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="9be708514ed0234ae80547704c5d5d30e888c502799d67c2ef0de848828cbf6d" name="c-ares-utils" arch="s390x">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="5f7c2c161a560cb239f730df58d828ae4f2ff38a8ad5c7f72567c1922a5fe02d" name="c-ares-utils" arch="x86_64">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="ce65fee07f79c3f1fb1aaaf3bef109b9f94a1908c1ce1a16b86f9c576da99a69" name="corepack18" arch="aarch64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="9ebc56d6e7cede8e8e44777bf6d6af9a01b8697cc490e68401c25c615b0daffb" name="corepack18" arch="s390x">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="c27955c9f70c6fc9dd72b35eb31d4ce09aa01f2b8f5878faaf6a5c497f6a2a1b" name="corepack18" arch="x86_64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="eb4dee617c1fa8a1a143786764afb3ecc1d6cc93eab9be2c78f6d25eeed2039c" name="cups" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="ac106bd69a98423a512051bcb2e5a038642ee99a4145fac0b3e8883d9e4ec292" name="cups" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="9b2e448faedf76d4ba65cc47a8bcbf9ce096e166e141d04f77d710892de5eafa" name="cups" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="f3c76c70c1fc36fab856e51e75424391a3eea0cc6b2cd6442ab016c22af2663c" name="cups" arch="src">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="53cb2dee2284d5023831ef131764982812ca48106fab1ef941b4a485f5e395c9" name="cups" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="1233ea062e160a907a3c00a109dd5694c57b3ad6d3a5163449e931acea369f54" name="cups-client" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="5b9b22010da7993b1eeb9c9e56da39c7c6e5ac2a4b6bb9096426428699ffe1b6" name="cups-client" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="521737c71b5e5b903ab55c877a5e961d260774e63bbaf457f0bd393a0d0d0bc5" name="cups-client" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="84ff912a3d2e3d6da8ca0cf3bd0d1be3f152f62ec48c28204bc0d41322d9e6e0" name="cups-client" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="69ac06682a00fc337756db82098c42650398dbd95b9aaf7ddbad7799e630bfd1" name="cups-config" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="7464330e5bbf1202d38b967a2d4164d18951416b7754a7269e92ff83a25b7f4f" name="cups-config" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="d9ed50be9bc669fda86875b763ad24c8b74d24064aab9883691855165c317efc" name="cups-config" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="32026d0981feab396d4a236db6027d4fc4c83b74197d2e3368a007b7e71218dc" name="cups-config" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="a4c1d64ba8890e0880973eb67a8707ebfb4a05a5f98c60d339057521fec6bf29" name="cups-ddk" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="47caace35f5d90a41097a5211cbe2270f67da63571ccfc62135f0c3494ef63d8" name="cups-ddk" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="7d4b782452cd3433c901edacdc8e74eded9151b20cd8c3e7379841f7967477fa" name="cups-ddk" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="3ae136d5e9dba3fd1d3f8c518012e4a76f70e2dd43026c1682c5b1c488ff2c1e" name="cups-ddk" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="f92f70c92b872e8bd13b1fccad06a8a63ab845fb56d3d931e5f4b78073e4e095" name="cups-devel" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="c785d6d0f2383930efc9f39166c0bd7100a6b360d47c33ac03ff1708b952d6a6" name="cups-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="24987b6e06ab5c72b1a3a6d4680b5ddff6def9083b4c2b9a0278f9ed4a9e3a47" name="cups-devel" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="3d3e6712b39bd3545facd46a356a73e89a09ed3a644e131c2a120a1363d4c1fb" name="cups-devel" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="ae09d6a4c7d6c2623612bc5e64d0eed254a6235dc1dfb322443369af414c69c6" name="cups-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="5fe727f22c059c2eb863bbe6242016276c997e09be932974f92dc9a0dd460d06" name="dracut" arch="aarch64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="715e8217e016860b44136e8be2fa1e10289c186f609c50c7a48088910e9b9bb4" name="dracut" arch="ppc64le">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="13ccaee6749734a15577d002a6ec52780bb700377119d9234dd4f1f9cd081596" name="dracut" arch="s390x">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="a93cc82bd1cf62f9db4273c8d74c3f1284b66dbdeabc08092282c043ac8b0e21" name="dracut" arch="src">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="300274a3b1559a70888a168565b0d4095ec7a08c01f4bd3468becf27be3e7527" name="dracut" arch="x86_64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="352353c20816624fba355fbbe0c7df0817e3f79fd30a5d2ec98b80a7e3302cb6" name="dracut-extra" arch="aarch64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="1d530c4d85075d571f1654230cb995ddc16f64da42b280f8719317c4b31547d1" name="dracut-extra" arch="ppc64le">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="8c8fb369d729a20729ddde4dfdf3fbdeeb508c3dde7cf0051c639017b47b3bea" name="dracut-extra" arch="s390x">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="4c3e1c51107ed8bbcd5fb4ea9e0c00529eb20f10154b70abe819cee3acd05cb9" name="dracut-extra" arch="x86_64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="eeff16dbe1742f2c3ddf5a9ee8d8ee805c83be13e1a5a50e1f5af0dae6a15f43" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="2f6b8434b2cc3617b2f89932e68774ad0252e79482b353e219e0738aeea29f08" name="dracut-fips" arch="ppc64le">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="279fea352e2fc216d4aa9356731f710621868f29b895a1f0608ed6e83f5c190f" name="dracut-fips" arch="s390x">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="71234012b73dd31a7e500bc324a474b108bb9e1dc781f8b0bf0ae0e30c529069" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="52ccb30b17613bd275869af66cbd445e8a9c0dc2a648083b8e10700803844486" name="dracut-ima" arch="aarch64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="a4989adc79cf341e0e1cab4c0324a240ab33b20e0ad674c7a689684dd3c0312b" name="dracut-ima" arch="ppc64le">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="7a023b2542b79d34cafccabbe01e9d1af3215728c41ee183897a2176221dba16" name="dracut-ima" arch="s390x">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="8d34fa3ca29b85ee0157acab65fcdf375c000c28253596c0c31faa01f14bc1cd" name="dracut-ima" arch="x86_64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="3b8cf252779e44e965d9ea31f0e784f77bd0d8f33bfe49d30463db8012d4378d" name="dracut-mkinitrd-deprecated" arch="aarch64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="ff1047c911c8f2139b6e6eb10087a8dc03ec3e8d02a08d4e2e01ebcf01bd0e0e" name="dracut-mkinitrd-deprecated" arch="ppc64le">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="275762bd30cfd0fcb45ec1300071ce78d84e7e15bab31277ce44f9214e1dca9e" name="dracut-mkinitrd-deprecated" arch="s390x">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="c1581067c679a7433de83240d23bab327d1b07d1ba94c4f5f60f5337d8f9247c" name="dracut-mkinitrd-deprecated" arch="x86_64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="ebf3f4e6d7e69ca107915192a78e9c2d6c4fcd59571d324e5f7d069e201a46a8" name="dracut-tools" arch="aarch64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="adc8ba9701926e1cdd101023a6f144e098e74b08bae3f625f090dd31c4f21349" name="dracut-tools" arch="ppc64le">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="d92b326718d7b7fd0f36ee1f3775ef993630298e7387da2a5f23a1e24d91587b" name="dracut-tools" arch="s390x">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="5baeff282fd3d624a533d9e617e5ca84296f5f331cd0a9a68a1e6efa14d887ab" name="dracut-tools" arch="x86_64">
  <version epoch="0" ver="055+suse.364.g4c1d0276" rel="150500.3.3.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
</package>
<package pkgid="c5351f54d2c373697720ccfcc831a9d3a5b919eb4b72a287e10748388b47e99a" name="frr" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="9c484b217302707f604837021bf6122560c0d9b65da8f329e4fad3820e9c3e71" name="frr" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="be254e49efb1330572800f90bcba0032358cbce2f9edf070e60265377b4cb653" name="frr" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="06fdb385b8da0f62114a3aa07498712f5d7f625d61ebc69b52cb24cbc145f890" name="frr" arch="src">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="638a60104012448c01fe8a5a4f87c1ec4793b274071ed626bf1cf3d49613576d" name="frr" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="c65a828d487b66d3aceeba02dbf7e56f6d86818ecc02a8af6a58758a5c19dee6" name="frr-devel" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="ad14707fe0a46d73df7c68f50004b123b150c65cd0b1e304d48b43f8e3703de3" name="frr-devel" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="e43164bab56244ff8d082cc4318a94ce6d3d053022714e13c1402d6b33714e7a" name="frr-devel" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="9e95a4639d68f2672e89ca85ed1c6952d6a20693ed1660fdfa99f0750dc05827" name="frr-devel" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="38c435583dc0f9e3c4647747992f60a392b45cbce38307d5e16f1dd5b0a4cfc4" name="go1.18-openssl" arch="aarch64">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="81b2d8e4e4c0264897d2b626f8a35a698ab931509b8fb020e8689f62169d8f91" name="go1.18-openssl" arch="ppc64le">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="22f328960948e41b8df62079fffe05754f7e1e859530fad08e7c5dd90f035adf" name="go1.18-openssl" arch="s390x">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="ce6123a58754a4e3292ddcbaad83562d8fc4a8ad27b39d04b92c22deccd6f755" name="go1.18-openssl" arch="src">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="c8321f93bfe59217e159642e87c63a48042903bd884192b97ab7cbbd5dae2b69" name="go1.18-openssl" arch="x86_64">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="a36b653ea07b1d4d010e187f0cdc104982be1e9701c1ac2e3dcf8d0f3d59e66c" name="go1.18-openssl-doc" arch="aarch64">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="79f6a8f66cebcca922b661844525cd304ed80d1c0a57c61cc1f09ac7cd8e31e9" name="go1.18-openssl-doc" arch="ppc64le">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="4d19de13e93dd6da94e269f079e20194f7652300ac85ebacb14f3d6f074cfc41" name="go1.18-openssl-doc" arch="s390x">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="a36bf55fc153f7de122888d57bea92d5fb2c967afcbcd1d645154969f552ffa1" name="go1.18-openssl-doc" arch="x86_64">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="c7eacc046a55c26d6c9cfb351c8b0aa8d5a071bf5a743445091fab9b4e1515ef" name="go1.18-openssl-race" arch="aarch64">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="79aefc18c04062d358d6747af89d80e31cee8721e8b7001df0f5aa5874e831ba" name="go1.18-openssl-race" arch="x86_64">
  <version epoch="0" ver="1.18.10.1" rel="150000.1.9.1"/>
  <changelog author="jkowalczyk@suse.com" date="1658318400">- Update to version 1.18.4.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.4-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.4 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1659355200">- go1.18.5 (released 2022-08-01) includes security fixes to the
  encoding/gob and math/big packages, as well as bug fixes to the
  compiler, the go command, the runtime, and the testing package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-32189
  * boo#1202035 CVE-2022-32189 go#53871
  * go#54095 math/big: index out of range in Float.GobDecode
  * go#53883 cmd/compile: interface conversion with generics reports "types from different scopes"
  * go#53875 cmd/go: livelock when computing module graph in a workspace with GOPROXY=off
  * go#53852 cmd/compile: internal compiler error: assertion failed
  * go#53847 runtime: modified timer results in extreme cpu load
  * go#53119 cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags
  * go#53112 runtime: gentraceback() dead loop on arm64 casued the process hang
  * go#52986 testing: TempDir RemoveAll cleanup failures with "The process cannot access the file because it is being used by another process."
  * go#52961 cmd/compile: miscompilation in pointer operations</changelog>
  <changelog author="dmueller@suse.com" date="1660910400">- Bootstrap using go1.16 on SLE-15 and newer. go1.16 is
  bootstrapped using gcc-go 11 or 12. This allows dropping older
  versions of Go from Factory.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1661169600">- Define go_bootstrap_version go1.16 without suse_version checks
- Simplify conditional gcc_go_version 12 on Tumbleweed, 11 elsewhere</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366400">- Update to version 1.18.5.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.5-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.5 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366401">- go1.18.6 (released 2022-09-06) includes security fixes to the
  net/http package, as well as bug fixes to the compiler, the go
  command, the pprof command, the runtime, and the crypto/tls,
  encoding/xml, and net packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-27664
  * go#53977 bsc#1203185 CVE-2022-27664 net/http: handle server errors after sending GOAWAY
  * go#54733 cmd/go: git fetch errors dropped when producing pseudo-versions for commits
  * go#54725 cmd/compile: compile failed with "Value live at entry"
  * go#54674 runtime: morestack_noctxt missing SPWRITE, causes "traceback stuck" assert
  * go#54664 runtime: segfault running ppc64/linux binaries with kernel 5.18
  * go#54659 cmd/go: go test -race does not set implicit race build tag
  * go#54642 crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension
  * go#54636 cmd/go: data race in TestScript
  * go#54603 cmd/compile: miscompilation of partially-overlapping array assignments
  * go#54502 cmd/link: Trampoline insertion breaks DWARF Line Program Table output on Darwin/ARM64
  * go#54464 cmd/pprof: graphviz node names are funny with generics
  * go#54128 encoding/xml: crash on android/arm64 due to https://go.dev/cl/417062
  * go#54074 net: WriteMsgUDPAddrPort should accept IPv4 destination addresses on IPv6 UDP sockets
  * go#54056 misc/cgo: TestSignalForwardingExternal sometimes fails with wrong signal SIGINT
  * go#53397 go/reflect: Incorrect behavior on arm64 when using MakeFunc / Call</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664366402">- Update to version 1.18.6.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.6-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.6 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1664884800">- go1.18.7 (released 2022-10-04) includes security fixes to the
  archive/tar, net/http/httputil, and regexp packages, as well as
  bug fixes to the compiler, the linker, and the go/types package.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41715 CVE-2022-2879 CVE-2022-2880
  * go#55950 boo#1204023 security: fix CVE-2022-41715 regexp/syntax: limit memory used by parsing regexps
  * go#55925 boo#1204024 security: fix CVE-2022-2879 archive/tar: unbounded memory consumption when reading headers
  * go#55842 boo#1204025 security: fix CVE-2022-2880 net/http/httputil: ReverseProxy should not forward unparseable query parameters
  * go#55151 fatal error: bulkBarrierPreWrite: unaligned arguments
  * go#55148 go/types: no way to construct the signature of append(s, "string"...) via the API
  * go#55113 cmd/link: new darwin linker warning on -pagezero_size and -no_pie deprecation
  * go#54918 cmd/compile: Value live at entry</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667217600">- Update to version 1.18.7.2 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.7-2-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.7 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667304000">- go1.18.8 (released 2022-11-01) includes security fixes to the
  os/exec and syscall packages, as well as bug fixes to the
  runtime.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41716
  * go#56327 boo#1204941 security: fix CVE-2022-41716 syscall, os/exec: unsanitized NUL in environment variables
  * go#56308 runtime: "runtime·lock: lock count" fatal error when cgo is enabled</changelog>
  <changelog author="jkowalczyk@suse.com" date="1667563200">- Update to version 1.18.8.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.8-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.8 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670328000">- go1.18.9 (released 2022-12-06) includes security fixes to the
  net/http and os packages, as well as bug fixes to cgo, the
  compiler, the runtime, and the crypto/x509 and os/exec packages.
  Refs boo#1193742 go1.18 release tracking
  CVE-2022-41717 CVE-2022-41720
  * go#57008 boo#1206135 security: fix CVE-2022-41717 net/http: limit canonical header cache by bytes, not entries
  * go#57005 boo#1206134 security: fix CVE-2022-41720 os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
  * go#56751 runtime,cmd/compile: apparent memory corruption in compress/flate
  * go#56709 net: builders failing TestLookupDotsWithRemoteSource and TestLookupGoogleSRV due to missing host for _xmpp-server._tcp.google.com
  * go#56675 x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll
  * go#56635 runtime: traceback stuck in runtime.systemstack
  * go#56556 cmd/compile: some x/sys versions no longer build due to "go:linkname must refer to declared function or variable"
  * go#56550 os/exec: Plan 9 build has been broken by a Windows security fix (also breaks 1.19.3 and 1.18.8)
  * go#56437 crypto/x509: respect GODEBUG changes during program lifetime
  * go#56396 runtime: on linux/PPC64, usleep computes incorrect tv_nsec parameter
  * go#56359 cmd/compile: panic: offset too large</changelog>
  <changelog author="jkowalczyk@suse.com" date="1670500800">- Update to version 1.18.9.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.9-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.9 into dev.boringcrypto.go1.18
  * [dev.boringcrypto.go1.18] crypto/tls: allow BoringCrypto to use 4096-bit keys</changelog>
  <changelog author="jkowalczyk@suse.com" date="1673352000">- go1.18.10 (released 2023-01-10) includes fixes to cgo, the
  compiler, the linker, and the crypto/x509, net/http, and syscall
  packages.
  Refs boo#1193742 go1.18 release tracking
  * go#57705 misc/cgo: backport needed for dlltool fix
  * go#57426 crypto/x509: Verify on macOS does not return typed errors
  * go#57344 cmd/compile: the loong64 intrinsic for CompareAndSwapUint32 function needs to sign extend its "old" argument.
  * go#57338 syscall, internal/poll: accept4-to-accept fallback removal broke Go code on Synology DSM 6.2 ARM devices
  * go#57213 os: TestLstat failure on Linux Aarch64
  * go#57211 reflect: sort.SliceStable sorts incorrectly on arm64 with less function created with reflect.MakeFunc and slice of sufficient length
  * go#57057 cmd/go: remove test dependency on gopkg.in service
  * go#57054 cmd/go: TestScript/version_buildvcs_git_gpg (if enabled) fails on linux longtest builders
  * go#57044 cgo: malformed DWARF TagVariable entry
  * go#57028 cmd/cgo: Wrong types in compiler errors with clang 14
  * go#56833 cmd/link/internal/ppc64: too-far trampoline is reused
  * go#56711 net: reenable TestLookupDotsWithRemoteSource and TestLookupGoogleSRV with a different target
  * go#56323 net/http: bad handling of HEAD requests with a body</changelog>
  <changelog author="jkowalczyk@suse.com" date="1674129600">- Update to version 1.18.10.1 cut from the go1.18-openssl-fips
  branch at the revision tagged go1.18.10-1-openssl-fips.
  * Merge branch dev.boringcrypto.go1.18 into go1.18-openssl-fips
  * Merge go1.18.10 into dev.boringcrypto.go1.18</changelog>
  <changelog author="jjindrak@suse.com" date="1677672000">- Fix for SG#65262, bsc#1208491:
  * go#57855 boo#1208270 security: fix CVE-2022-41723 bsc1208491.patch
  * go#58001 boo#1208271 security: fix CVE-2022-41724 bsc1208491-41724.patch
  * go#58006 boo#1208272 security: fix CVE-2022-41725 bsc1208491-41725.patch</changelog>
  <changelog author="mliska@suse.cz" date="1681387200">- Use gcc13 compiler for Tumbleweed.</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473600">- Improvements to go1.x packaging spec:
  * On Tumbleweed bootstrap with current default gcc13 and gccgo118
  * On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap
    using go1.x package (%bcond_without gccgo). This is no longer
    needed on current SLE-12:Update and removing will consolidate
    the build configurations used.
  * Change source URLs to go.dev as per Go upstream
  * On x86_64 export GOAMD64=v1 as per the current baseline.
    At this time forgo GOAMD64=v3 option for x86_64_v3 support.
  * On x86_64 %define go_amd64=v1 as current instruction baseline</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473601">- Add subpackage go1.x-libstd for compiled shared object libstd.so.
  Refs jsc#PED-1962
  * Main go1.x package included libstd.so in previous versions
  * Split libstd.so into subpackage that can be installed standalone
  * Continues the slimming down of main go1.x package by 40 Mb
  * Experimental and not recommended for general use, Go currently has no ABI
  * Upstream Go has not committed to support buildmode=shared long-term
  * Do not use in packaging, build static single binaries (the default)
  * Upstream Go go1.x binary releases do not include libstd.so
  * go1.x Suggests go1.x-libstd so not installed by default Recommends
  * go1.x-libstd does not Require: go1.x so can install standalone
  * Provides go-libstd unversioned package name
  * Fix build step -buildmode=shared std to omit -linkshared
- Packaging improvements:
  * go1.x Suggests go1.x-doc so not installed by default Recommends
  * Use Group: Development/Languages/Go instead of Other</changelog>
  <changelog author="jkowalczyk@suse.com" date="1681473602">- Build subpackage go1.x-libstd compiled shared object libstd.so
  only on Tumbleweed at this time.
  Refs jsc#PED-1962</changelog>
</package>
<package pkgid="d67ea3cd4e4c178ef5bdb3854aad9a5cddba0165b4623974837d22a583717ed7" name="google-cloud-sap-agent" arch="aarch64">
  <version epoch="0" ver="1.5.1" rel="150100.3.7.1"/>
  <changelog author="rjschwei@suse.com" date="1676548800">- Initial build (#jsc-PED-2879)
  + Version 1.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683547200">- Update to version 1.5.1 (bsc#1210464)
  + No upstream changelog provided
- Raise golang API version to 1.20</changelog>
</package>
<package pkgid="ebe4b9e63f1163ab44c1251863b15458a3575d1771a60e225b505ab146d3000a" name="google-cloud-sap-agent" arch="ppc64le">
  <version epoch="0" ver="1.5.1" rel="150100.3.7.1"/>
  <changelog author="rjschwei@suse.com" date="1676548800">- Initial build (#jsc-PED-2879)
  + Version 1.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683547200">- Update to version 1.5.1 (bsc#1210464)
  + No upstream changelog provided
- Raise golang API version to 1.20</changelog>
</package>
<package pkgid="4cd4f0cb7cdd70599df7c74706eb3928466639253b9fdeb874324fa371e1ea3b" name="google-cloud-sap-agent" arch="s390x">
  <version epoch="0" ver="1.5.1" rel="150100.3.7.1"/>
  <changelog author="rjschwei@suse.com" date="1676548800">- Initial build (#jsc-PED-2879)
  + Version 1.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683547200">- Update to version 1.5.1 (bsc#1210464)
  + No upstream changelog provided
- Raise golang API version to 1.20</changelog>
</package>
<package pkgid="024a98520bb68db94735f2219b64af7c37daadbea295fb2c03363360f917f038" name="google-cloud-sap-agent" arch="src">
  <version epoch="0" ver="1.5.1" rel="150100.3.7.1"/>
  <changelog author="rjschwei@suse.com" date="1676548800">- Initial build (#jsc-PED-2879)
  + Version 1.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683547200">- Update to version 1.5.1 (bsc#1210464)
  + No upstream changelog provided
- Raise golang API version to 1.20</changelog>
</package>
<package pkgid="2fad5f8c4d15a03cf39a0f8d97e3a132764bc989aba0fefdc6984d9788c8212c" name="google-cloud-sap-agent" arch="x86_64">
  <version epoch="0" ver="1.5.1" rel="150100.3.7.1"/>
  <changelog author="rjschwei@suse.com" date="1676548800">- Initial build (#jsc-PED-2879)
  + Version 1.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683547200">- Update to version 1.5.1 (bsc#1210464)
  + No upstream changelog provided
- Raise golang API version to 1.20</changelog>
</package>
<package pkgid="4da213cf2a2507d156eca991a683e90d97affa1edae307f6f50e01a0c84394af" name="jansi" arch="aarch64">
  <version epoch="0" ver="2.4.0" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1549281600">- Initial package of jansi 1.17.1
- Add build.xml file for building with ant</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Fix double-shipping of documentation
- Avoid name repetition in summary (potential rpmlint warning</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Remove reference to the parent pom since we are not building
  using Maven.
- Make tests conditional and switched off by default</changelog>
  <changelog author="fstrba@suse.com" date="1561636800">- Remove the reference to jansi-project parent from jansi pom
- Resolve manually jansi-native-version variable so that ivy
  understands it</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1652702400">- Upgrade the latest upstream release 2.4.0
  * Integrates jansi-native libraries
  * Does not depend on jansi-native and hawtjni-runtime
- Make the jansi package archful since it installs a native
  library and jni jar
- Added patch:
  * jansi-jni.patch
    + Give a possibility to load the native libjansi.so from
    system</changelog>
  <changelog author="fstrba@suse.com" date="1682510400">- Fetch sources using source_service and don't distribute legally
  spurious files (bsc#1210877)</changelog>
</package>
<package pkgid="3dc93ce514dc8399313f673204d18bd225ee5ab6ce2633b7703c01e24506ad2c" name="jansi" arch="ppc64le">
  <version epoch="0" ver="2.4.0" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1549281600">- Initial package of jansi 1.17.1
- Add build.xml file for building with ant</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Fix double-shipping of documentation
- Avoid name repetition in summary (potential rpmlint warning</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Remove reference to the parent pom since we are not building
  using Maven.
- Make tests conditional and switched off by default</changelog>
  <changelog author="fstrba@suse.com" date="1561636800">- Remove the reference to jansi-project parent from jansi pom
- Resolve manually jansi-native-version variable so that ivy
  understands it</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1652702400">- Upgrade the latest upstream release 2.4.0
  * Integrates jansi-native libraries
  * Does not depend on jansi-native and hawtjni-runtime
- Make the jansi package archful since it installs a native
  library and jni jar
- Added patch:
  * jansi-jni.patch
    + Give a possibility to load the native libjansi.so from
    system</changelog>
  <changelog author="fstrba@suse.com" date="1682510400">- Fetch sources using source_service and don't distribute legally
  spurious files (bsc#1210877)</changelog>
</package>
<package pkgid="d429758b32733e1bed311a54b2264e7ea536b36cbe69818f6f13a2a3a7929dd3" name="jansi" arch="s390x">
  <version epoch="0" ver="2.4.0" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1549281600">- Initial package of jansi 1.17.1
- Add build.xml file for building with ant</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Fix double-shipping of documentation
- Avoid name repetition in summary (potential rpmlint warning</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Remove reference to the parent pom since we are not building
  using Maven.
- Make tests conditional and switched off by default</changelog>
  <changelog author="fstrba@suse.com" date="1561636800">- Remove the reference to jansi-project parent from jansi pom
- Resolve manually jansi-native-version variable so that ivy
  understands it</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1652702400">- Upgrade the latest upstream release 2.4.0
  * Integrates jansi-native libraries
  * Does not depend on jansi-native and hawtjni-runtime
- Make the jansi package archful since it installs a native
  library and jni jar
- Added patch:
  * jansi-jni.patch
    + Give a possibility to load the native libjansi.so from
    system</changelog>
  <changelog author="fstrba@suse.com" date="1682510400">- Fetch sources using source_service and don't distribute legally
  spurious files (bsc#1210877)</changelog>
</package>
<package pkgid="72a6486d0b1aff725ccf8d196ade692bdb3760c6384479bec582540b8ecf9ecf" name="jansi" arch="src">
  <version epoch="0" ver="2.4.0" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1549281600">- Initial package of jansi 1.17.1
- Add build.xml file for building with ant</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Fix double-shipping of documentation
- Avoid name repetition in summary (potential rpmlint warning</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Remove reference to the parent pom since we are not building
  using Maven.
- Make tests conditional and switched off by default</changelog>
  <changelog author="fstrba@suse.com" date="1561636800">- Remove the reference to jansi-project parent from jansi pom
- Resolve manually jansi-native-version variable so that ivy
  understands it</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1652702400">- Upgrade the latest upstream release 2.4.0
  * Integrates jansi-native libraries
  * Does not depend on jansi-native and hawtjni-runtime
- Make the jansi package archful since it installs a native
  library and jni jar
- Added patch:
  * jansi-jni.patch
    + Give a possibility to load the native libjansi.so from
    system</changelog>
  <changelog author="fstrba@suse.com" date="1682510400">- Fetch sources using source_service and don't distribute legally
  spurious files (bsc#1210877)</changelog>
</package>
<package pkgid="fbf3f6a064fbd9f95458af1b6bdf247da1535afa72c3276656015c80090f42de" name="jansi" arch="x86_64">
  <version epoch="0" ver="2.4.0" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1549281600">- Initial package of jansi 1.17.1
- Add build.xml file for building with ant</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Fix double-shipping of documentation
- Avoid name repetition in summary (potential rpmlint warning</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Remove reference to the parent pom since we are not building
  using Maven.
- Make tests conditional and switched off by default</changelog>
  <changelog author="fstrba@suse.com" date="1561636800">- Remove the reference to jansi-project parent from jansi pom
- Resolve manually jansi-native-version variable so that ivy
  understands it</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1652702400">- Upgrade the latest upstream release 2.4.0
  * Integrates jansi-native libraries
  * Does not depend on jansi-native and hawtjni-runtime
- Make the jansi package archful since it installs a native
  library and jni jar
- Added patch:
  * jansi-jni.patch
    + Give a possibility to load the native libjansi.so from
    system</changelog>
  <changelog author="fstrba@suse.com" date="1682510400">- Fetch sources using source_service and don't distribute legally
  spurious files (bsc#1210877)</changelog>
</package>
<package pkgid="be08e564116ca684a22c0d70bf05d8ae35fd6e8dcc2f44aa86024bd570c15934" name="jansi-javadoc" arch="noarch">
  <version epoch="0" ver="2.4.0" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1549281600">- Initial package of jansi 1.17.1
- Add build.xml file for building with ant</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Fix double-shipping of documentation
- Avoid name repetition in summary (potential rpmlint warning</changelog>
  <changelog author="fstrba@suse.com" date="1554811200">- Remove reference to the parent pom since we are not building
  using Maven.
- Make tests conditional and switched off by default</changelog>
  <changelog author="fstrba@suse.com" date="1561636800">- Remove the reference to jansi-project parent from jansi pom
- Resolve manually jansi-native-version variable so that ivy
  understands it</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1652702400">- Upgrade the latest upstream release 2.4.0
  * Integrates jansi-native libraries
  * Does not depend on jansi-native and hawtjni-runtime
- Make the jansi package archful since it installs a native
  library and jni jar
- Added patch:
  * jansi-jni.patch
    + Give a possibility to load the native libjansi.so from
    system</changelog>
  <changelog author="fstrba@suse.com" date="1682510400">- Fetch sources using source_service and don't distribute legally
  spurious files (bsc#1210877)</changelog>
</package>
<package pkgid="995f66ffdb0356022bdfda3c028133308441c4227e92bc473a5a2efa9cd13f54" name="java-1_8_0-ibm" arch="src">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="ed2c1add3189eb9f7f18b81ce27f7394320c543a2453e72772b5ca335188b79a" name="java-1_8_0-ibm" arch="ppc64le">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="4bf4e1acdb63512e281942e025fbe748e3326bc6f529bb4d599a97b3b3a6b04b" name="java-1_8_0-ibm" arch="s390x">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="9a5696eb9673e6dabdfc02a6f8e71e1530b3f34dbed672176053c5b796c6a8f3" name="java-1_8_0-ibm" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="46865e76c21ad070b9de2ea3084d30ca8146858f506b911db65d2ab001bd086f" name="java-1_8_0-ibm-32bit" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="57b80b7c65f32c20f941c8ca21bcd8c58c51bcf095edba693884f15bfb7d262d" name="java-1_8_0-ibm-alsa" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="e6767dadbe68ad631724f62194b587d465cdfcf0905f629b18274cdf777e6575" name="java-1_8_0-ibm-demo" arch="ppc64le">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="130b9462cd79c8027a30a94425d73e4ae771da86c2ad9f653b54d206f742fe7e" name="java-1_8_0-ibm-demo" arch="s390x">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="11cce560443a226a45aafa970602b00e3acd19baea226e157dcaf41adf06d2a0" name="java-1_8_0-ibm-demo" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="abfb51e2bd89c7b6dbb8e47a1a15d7b1b10cddff0cf0b2df3a3b2d011754f7c3" name="java-1_8_0-ibm-devel" arch="ppc64le">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="5073767876d0303728debdba7e6ea61c8581bb28ab0869f48e506f806b4df208" name="java-1_8_0-ibm-devel" arch="s390x">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="1f0c569eb160e03ae311d46c3fa8b41235b7de4943f9b25c99ba30cbddb052c3" name="java-1_8_0-ibm-devel" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="b761d22d4d9766b324d791132f00b62ce1f605c6eccf023e9cc95b92b98391c4" name="java-1_8_0-ibm-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="38f3131e822807929ab9b3581cccfe21c1fad851863546da237b8c7e7cfbf340" name="java-1_8_0-ibm-plugin" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="f6824c604937b8c6495823162b8916e99318f1a4c35846c7b974230482aaac4c" name="java-1_8_0-ibm-src" arch="ppc64le">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="22aee178b7e429c4485a7b8e1a389157398825333916f366aea2456344610da7" name="java-1_8_0-ibm-src" arch="s390x">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="cc58d5f3b8b880a344c0f94d32043e21290ebc9850bb186bab39fe2e1c6a1c69" name="java-1_8_0-ibm-src" arch="x86_64">
  <version epoch="0" ver="1.8.0_sr8.5" rel="150000.3.74.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1591704000">- Fix update-alternatives for the 32bit packages in baselibs.conf [bsc#1171352]</changelog>
  <changelog author="pmonreal@suse.com" date="1597406400">- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]
  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581
  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
  CVE-2019-17639
  * Class Libraries:
  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
  - TRANSLATION MESSAGES UPDATE FOR JCL
  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A
  * Java Virtual Machine:
  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
  * JIT Compiler:
  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD
    IN DEBUGGING MODE
  - INTERMITTENT ASSERTION FAILURE REPORTED
  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD
  - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
  - SEGMENTATION FAULT WHILE COMPILING A METHOD
  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL
    APPLICATION ON IBM Z PLATFORM
  * Security:
  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO
    NON DEFAULT VALUE
  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH
    DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM
    KEYFACTORY CLASS</changelog>
  <changelog author="pmonreal@suse.com" date="1601294400">- Update to Java 8.0 Service Refresh 6 Fix Pack 16
  * Java ifix for z15 compression problem [bsc#1175295]
  * Class Libraries:
  - z15 high utilization following Z/VM and Linux migration from
    z14 To z15
  * Java Virtual Machine:
  - Assertion failed when trying to write a class file
  - Assertion failure at modronapi.cpp
  - Improve the performance of defining and finding classes
  * JIT Compiler:
  - An assert in ppcbinaryencoding.cpp may trigger when running
    with traps disabled on power
  - AOT field offset off by n bytes
  - Segmentation fault in jit module on ibm z platform</changelog>
  <changelog author="pmonreal@suse.com" date="1608033600">- Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943]
  CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779
  CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  * Class libraries:
  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time
    that the set timeout
  - Z/OS specific C function send_file is changing the file pointer
    position
  * Java Virtual Machine:
  - Crash on iterate java stack
  - Java process hang on SIGTERM
  * JIT Compiler:
  - JMS performance regression from JDK8 SR5 FP40 TO FP41</changelog>
  <changelog author="pmonreal@suse.com" date="1613131200">- Update to Java 8.0 Service Refresh 6 Fix Pack 25
  [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  * CVE-2020-27221: Potential for a stack-based buffer overflow
    when the virtual machine or JNI natives are converting from
    UTF-8 characters to platform encoding.
  * CVE-2020-14803: Unauthenticated attacker with network access
    via multiple protocols allows to compromise Java SE.</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Update to Java 8.0 Service Refresh 6 Fix Pack 26
  * Java Virtual Machine:
  - Behaviour change in getmethod for java8_sr6_fp20
  - Crash when outputting to verbose GC log using the specifier
    characters
  - Outofmemoryerror happens due to nursery heap space shortage
  * JIT Compiler:
  - Occasional assertion being triggered in code generation
  - SEGV when using hashmap$hashiterator.nextnode() in
    multiple threads concurrently</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Update to Java 8.0 Service Refresh 6 Fix Pack 30
  [bsc#1185056, CVE-2021-2161][bsc#1185055, CVE-2021-2163]
  * Service, Build, Packaging and Deliver:
  - Symlink issue reported for javaws in jre packages
  - ibmjceplus security provider depends on msvcr120.dll on windows
  * Class Libraries:
  - Exception in pure ipv6 environment in IBM sdk
  - Fix security vulnerability CVE-2021-2161
  - Update cacerts to include certificates from entrust and globalsign
  - Update timezone information to the latest tzdata2021a
  * Java Virtual Machine:
  - Sssertion failed at copyforwardscheme.cpp because a tag slot
    (0x3) was treated as an object
  - GPF event from method unlinkclassloadingconstraints
  - JVM takes more time to start up
  - xgc:classunloadingkickoffthreshold not working as expected
  * JIT Compiler:
  - The JIT incorrectly compiles a method consisting of non-javac
    generated bytecodes from java 8.0.6.20 and up to 8.0.6.30
  * Security:
  - httpsurlconnection drops the timeout and hangs forever in read
  - sslsocket that is never bound or connected leaks socket resources
  - TLS connection always receives close_notify exception
  - JSSE fails to open racf keystores
  - Kerberos ticket renewal fails with debug enabled following
    java.lang.illegalstateexception
  - Update JSSE to oracle jdk8u281 fix level</changelog>
  <changelog author="pmonreal@suse.com" date="1641211200">- Update to Java 8.0 Service Refresh 7 Fix Pack 0 [bsc#1194232]
  [bsc#1194198, bsc#1192052, CVE-2021-41035]
  [bsc#1191902, CVE-2021-35560] [bsc#1191904, CVE-2021-35578]
  [bsc#1191914, CVE-2021-35586] [bsc#1191913, CVE-2021-35564]
  [bsc#1191911, CVE-2021-35559] [bsc#1191910, CVE-2021-35556]
  [bsc#1191909, CVE-2021-35565] [bsc#1191905, CVE-2021-35588]
- Update to Java 8.0 Service Refresh 6 Fix Pack 35
  [bsc#1188565, CVE-2021-2369] [bsc#1188564, CVE-2021-2341]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345600">- Fix a javaws broken symlink [bsc#1195146]</changelog>
  <changelog author="pmonreal@suse.com" date="1647345601">- Update to Java 8.0 Service Refresh 7 Fix Pack 5 [bsc#1197126]
  * https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities
    [bsc#1194927, CVE-2022-21366] [bsc#1194928, CVE-2022-21365]
    [bsc#1194929, CVE-2022-21360] [bsc#1196500, CVE-2022-21349]
    [bsc#1194941, CVE-2022-21341] [bsc#1194940, CVE-2022-21340]
    [bsc#1194939, CVE-2022-21305] [bsc#1194930, CVE-2022-21277]
    [bsc#1194931, CVE-2022-21299] [bsc#1194932, CVE-2022-21296]
    [bsc#1194933, CVE-2022-21282] [bsc#1194934, CVE-2022-21294]
    [bsc#1194935, CVE-2022-21293] [bsc#1194925, CVE-2022-21291]
    [bsc#1194937, CVE-2022-21283] [bsc#1194926, CVE-2022-21248]
    [CVE-2022-21271]</changelog>
  <changelog author="pmonreal@suse.com" date="1658145600">- Update to Java 8.0 Service Refresh 7 Fix Pack 6
  * Java Virtual Machine: Crash while generating javacore, or
    javacore contains 'Unable to walk in-flight data on call stack'
    instead of java stack
  * JIT Compiler:
  - Java JIT, bad field reference from a tenured object into
    the nursery
  - JIT compiler crash with vmstate=0x0005ff04
  * XML: Fix security vulnerability CVE-2022-21299</changelog>
  <changelog author="pmonreal@suse.com" date="1658145601">- Update to Java 8.0 Service Refresh 7 Fix Pack 10 [bsc#1201643]
  [bsc#1198671, CVE-2022-21476] [bsc#1198670, CVE-2022-21449]
  [bsc#1198673, CVE-2022-21496] [bsc#1198674, CVE-2022-21434]
  [bsc#1198672, CVE-2022-21426] [bsc#1198675, CVE-2022-21443]
  [bsc#1191912, CVE-2021-35561] [bsc#1194931, CVE-2022-21299]
  * Class Libraries:
  - BigDecimal gives incorrect arithmetic results for the add
    and subtract operations on the result of a divide
  * Java Virtual Machine:
  - jstacktrace sub-option of xtrace doesn't print java stack
    while doing method trace
  * Security:
  - 8217633: Configurable Extensions with system properties
  - 8241248: NullPointerException in com.ibm.jsse2.ssl.HKDF.extract
  - 8270344: Session resumption errors
  - 8277967: Validate the SSLLogger object in KeyShareExtension
  - JVM crashes computing Diffie-Hellman shared secrets and JNI
    errors while creating elliptic curve public key using IBMJCEPlus
  - Key Certificate Manager authority key identifier value incorrect
  - SSLv2Hello property value is ignored if specified in
    jdk.tls.disabledAlgorithms and SSLv2Hello is set by
    setEnabledProtocols()
  - There is a memory growth observed during digest operations
    using IBMJCEPlus as the provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1660305600">- Update to Java 8.0 Service Refresh 7 Fix Pack 11 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Defect Fixes:
  - Java Virtual Machine: Long dely in AttachAPI</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Update to Java 8.0 Service Refresh 7 Fix Pack 15 [bsc#1202427]
  [bsc#1201684, CVE-2022-34169] [bsc#1201692, CVE-2022-21541]
  [bsc#1201685, CVE-2022-21549] [bsc#1201694, CVE-2022-21540]
  * Correction: These CVEs have been fixed in version 8.0-7.15 and
    not in 8.0-7.11 as mentioned in the previous changelog entry.</changelog>
  <changelog author="pmonreal@suse.com" date="1665748800">- Update to Java 8.0 Service Refresh 7 Fix Pack 16
  * Java Virtual Machine
  - Assertion failure at ClassLoaderRememberedSet.cpp
  - Assertion failure at StandardAccessBarrier.cpp when
  - Xgc:concurrentScavenge is set.
  - GC can have unflushed ownable synchronizer objects which
  can eventually lead to heap corruption and failure when
  - Xgc:concurrentScavenge is set.
  * JIT Compiler:
  - Incorrect JIT optimization of Java code
  - JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
  * Reliability and Serviceability:
  - javacore with "kill -3" SIGQUIT signal freezes Java process</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]
  [bsc#1204472, CVE-2022-21628] [bsc#1204471, CVE-2022-21626]
  [bsc#1204468, CVE-2022-21618] [bsc#1204480, CVE-2022-39399]
  [bsc#1204475, CVE-2022-21624] [bsc#1204473, CVE-2022-21619]
  * Security:
  - The IBM ORB Does Not Support Object-Serialisation Data Filtering
  - Large Allocation In CipherSuite
  - Avoid Evaluating Sslalgorithmconstraints Twice
  - Cache The Results Of Constraint Checks
  - An incorrect ShortBufferException is thrown by IBMJCEPlus,
    IBMJCEPlusFIPS during cipher update operation
  - Disable SHA-1 Signed Jars For Ea
  - JSSE Performance Improvement
  - Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
  * Java 8/Orb:
  - Upgrade ibmcfw.jar To Version o2228.02
  * Class Libraries:
  - Crash In Libjsor.So During An Rdma Failover
  - High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  - Update Timezone Information To The Latest tzdata2022c
  * Jit Compiler:
  - Crash During JIT Compilation
  - Incorrect JIT Optimization Of Java Code
  - Incorrect Return From Class.isArray()
  - Unexpected ClassCastException
  - Performance Regression When Calling VM Helper Code On X86
  * X/Os Extentions:
  - Add RSA-OAEP Cipher Function To IBMJCECCA</changelog>
  <changelog author="pmonreal@suse.com" date="1671105600">- IBM Security Update November 2022: [bsc#1205302, bsc#1204703]
  * The security vulnerability CVE-2022-3676 was fixed in version
    8.0.7.20, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1680523200">- Update to Java 8.0 Service Refresh 8: [bsc#1208480]
  * Security fixes: [bsc#1207246, CVE-2023-21835]
    [bsc#1207249, CVE-2023-21830] [bsc#1207248, CVE-2023-21843]
  * New Features/Enhancements:
  - Add RSA-PSS signature to IBMJCECCA.
  * Defect Fixes:
  - IJ45437 Service, Build, Packaging and Deliver: Getting
    FIPSRUNTIMEEXCEPTION when calling java code:
    MESSAGEDIGEST.GETINSTANCE("SHA256", "IBMJCEFIPS"); in MAC
  - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
  - IJ45280 Class Libraries: Update timezone information to the
    latest TZDATA2022F
  - IJ44896 Class Libraries: Update timezone information to the
    latest TZDATA2022G
  - IJ45436 Java Virtual Machine: Stack walking code gets into
    endless loop, hanging the application
  - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified
    multiple times on the same command line the first option takes
    precedence instead of the last
  - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()
    due to a NULL pointer
  - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static
    final field object properties
  - IJ44107 JIT Compiler: JIT publishes new object reference to other
    threads without executing a memory flush
  - IX90193 ORB: Fix security vulnerability CVE-2023-21830
  - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has
    similar error of JDK-8253368
  - IJ45148 Security: code changes for tech preview
  - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,
    using IBMJCEPLUS, causes a small memory leak
  - IJ44172 Security: Disable SHA-1 signed jars for EA
  - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,
    using IBMJCEPLUS, Causes a small memory leak
  - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305
    crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
  - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA
    during signature operations resulting in Java cores
  - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
  - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain
    a SUBJECTKEYIDENTIFIER extension
  - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()
    method uses SHA1XXXX signature algorithms to match private and public keys
  - IJ45203 Security: RSAPSS multiple names for KEYTYPE
  - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
  - IJ40002 XML: Fix security vulnerability CVE-2022-21426</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- IBM Security Update April 2023: [bsc#1210711, CVE-2023-30441]
  * The security vulnerability CVE-2023-30441 was fixed in version
    8.0.7.15 as reported in the advisory, adding the reference here.</changelog>
  <changelog author="pmonreal@suse.com" date="1686052800">- Update to Java 8.0 Service Refresh 8 Fix Pack 5 [bsc#1210826]
  * Security Fixes:
  - IJ46965 Class Libraries: [bsc#1210628, CVE-2023-21930]
  - IJ46972 Class Libraries: [bsc#1210631, CVE-2023-21937]
  - IJ46974 Class Libraries: [bsc#1210632, CVE-2023-21938]
  - IJ46969 Class Libraries: [bsc#1210634, CVE-2023-21939]
  - IJ46971 Class Libraries: [bsc#1210637, CVE-2023-21968]
  - IJ47000 Java Virtual Machine: [bsc#1211615, CVE-2023-2597]
  - IJ46967 Security: [bsc#1210636, CVE-2023-21967]
  - Vulnerability in the Oracle Java SE, Oracle GraalVM
    Enterprise Edition product of Oracle Java SE (component:
    Hotspot). [bsc#1210635, CVE-2023-21954]
  * Defect Fixes:
  - IX90194 Java 8/Orb: ORB'S SOCKET TIMER THREAD HANGS IN COM.IBM.JSSE2
  - IJ47092 Class Libraries: DEPRECATION OF RDMA
  - IJ45888 Java Virtual Machine: ASSERTION FAILURE AT SCAVENGER.CPP
  - IJ46813 Java Virtual Machine: JVM'S SIGUSR2 SIGNAL HANDLER
    OVERWRITES NATIVE APP'S SIGUSR2 SIGNAL HANDLER
  - IJ47094 Java Virtual Machine: FIX THE MISMATCHED FLAGS IN THE
    STACKMAPS OF BYTECODE DURING THE BYTECODE VERIFICATION
  - IJ45583 Java Virtual Machine: SOME CODE FOR IBM JAVA 8 COMPILED
    WITH ARCH(10) ON Z/OS
  - IJ46192 JIT Compiler: CRASH WHEN USING IBMJCEPLUS WITH BALANCED GC
  - IJ45659 JIT Compiler: JAVA JIT: MISSING TYPE CHECKING ALLOWED
    INVALID OBJECT FIELD ACCESSES
  - IJ46620 Security: ADD NEW SUPPORT FOR RSAPSS SIGNATURES RECEIVED
    BY CERTPATH WITHIN OCSP RESPONSES
  - IJ45919 Security: DISABLE RSA KEY TRANSPORT CIPHER SUITES IN
    FIPS 140-3 TECH PREVIEW
  - IJ46173 Security: IBMJCEPLUS, IBMJCEPLUSFIPS PROVIDERS THROW AN
    INCORRECT JAVA.SECURITY.SIGNATUREEXCEPTION
  - IJ45883 Security: IBMJCEPLUSFIPS PROVIDER FAILS DURING SIGNATURE
    OPERATIONS USING NON FIPS140-2 COMPLIANT EC KEYS.
  - IJ45182 Security: IBMJCEPLUS PROVIDER FAILS IN RSAPSS DURING
    SIGNATURE OPERATIONS RESULTING IN JAVA CORES.
  - IJ46193 Security: SSLCONTEXT.GETINSTANCE FAILURES CAUSE
    JAVA.LANG.EXCEPTIONININITIALIZERERROR
  - IJ45599 Security: UPDATE IKEYMAN TO SUPPORT PBES2 AND OTHER MINOR
    FIXES
  - IJ45598 Security: UPDATE KDB FORMAT TO SUPPORT PBES2
  - IJ45789 Security: -XVERIFY:ALL CAUSES FAILURE IN JSSE
  - PH52970 z/OS Extentions: CHACHA20-POLY1305 CIPHER DECRYPTION CHUNK
    UPDATE FIX
  - PH52876 z/OS Extentions: RSA-PSS SIGNATURE SUPPORT FOR RSA HARDWARE
    KEYS OVER TLSV1.3</changelog>
</package>
<package pkgid="bb97cdc3f442d0daa80eed0d9b7b0776def9267c339e15ac417f3f2c46904a08" name="junit5" arch="noarch">
  <version epoch="0" ver="5.8.2" rel="150200.3.6.1"/>
  <changelog author="fstrba@suse.com" date="1554984000">- Initial packaging of junit5 5.4.0</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to junit5 5.5.2
- Distribute also the manifest-only junit-jupiter artifact
- Build the console by default, since picocli package exists now</changelog>
  <changelog author="fstrba@suse.com" date="1646308800">- Package also the bill-of-materials pom</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Update to upstream version 5.8.2
  * Fixes:
    + Text blocks in @CsvSource are treated like CSV files
    + CSV headers in display names for @CsvSource and
    @CsvFileSource
    + Custom quote character support in @CsvSource and
    @CsvFileSource
    + Support for text blocks in @CsvSource
    + Java 18 support in the JRE enum
    + Access to the ExecutionMode in the ExtensionContext
    + Declarative test suites via @Suite classes
    + LauncherSession and accompanying listener
    + New UniqueIdTrackingListener
    + More fine-grained Java Flight Recorder events
    + Java Flight Recorder support on Java 8 Update 262 or
    higher
    + Test class ordering
    + @TempDir can be used to create multiple temporary
    directories
    + Extension registration via @ExtendWith on fields and
    parameters
    + Auto-close support for arguments in @ParameterizedTest
    methods
- Fix the classpath of console application so that it actually
  works</changelog>
</package>
<package pkgid="99ffcb68fd4fcad97a5290610b56fc36d728de3df103019b540849e50f54cfb9" name="junit5" arch="src">
  <version epoch="0" ver="5.8.2" rel="150200.3.6.1"/>
  <changelog author="fstrba@suse.com" date="1554984000">- Initial packaging of junit5 5.4.0</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to junit5 5.5.2
- Distribute also the manifest-only junit-jupiter artifact
- Build the console by default, since picocli package exists now</changelog>
  <changelog author="fstrba@suse.com" date="1646308800">- Package also the bill-of-materials pom</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Update to upstream version 5.8.2
  * Fixes:
    + Text blocks in @CsvSource are treated like CSV files
    + CSV headers in display names for @CsvSource and
    @CsvFileSource
    + Custom quote character support in @CsvSource and
    @CsvFileSource
    + Support for text blocks in @CsvSource
    + Java 18 support in the JRE enum
    + Access to the ExecutionMode in the ExtensionContext
    + Declarative test suites via @Suite classes
    + LauncherSession and accompanying listener
    + New UniqueIdTrackingListener
    + More fine-grained Java Flight Recorder events
    + Java Flight Recorder support on Java 8 Update 262 or
    higher
    + Test class ordering
    + @TempDir can be used to create multiple temporary
    directories
    + Extension registration via @ExtendWith on fields and
    parameters
    + Auto-close support for arguments in @ParameterizedTest
    methods
- Fix the classpath of console application so that it actually
  works</changelog>
</package>
<package pkgid="2c4581e5372dc8339ca9fefb4439dc3981d8e830c07205232df9bf60ef5d35cd" name="junit5-bom" arch="noarch">
  <version epoch="0" ver="5.8.2" rel="150200.3.6.1"/>
  <changelog author="fstrba@suse.com" date="1554984000">- Initial packaging of junit5 5.4.0</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to junit5 5.5.2
- Distribute also the manifest-only junit-jupiter artifact
- Build the console by default, since picocli package exists now</changelog>
  <changelog author="fstrba@suse.com" date="1646308800">- Package also the bill-of-materials pom</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Update to upstream version 5.8.2
  * Fixes:
    + Text blocks in @CsvSource are treated like CSV files
    + CSV headers in display names for @CsvSource and
    @CsvFileSource
    + Custom quote character support in @CsvSource and
    @CsvFileSource
    + Support for text blocks in @CsvSource
    + Java 18 support in the JRE enum
    + Access to the ExecutionMode in the ExtensionContext
    + Declarative test suites via @Suite classes
    + LauncherSession and accompanying listener
    + New UniqueIdTrackingListener
    + More fine-grained Java Flight Recorder events
    + Java Flight Recorder support on Java 8 Update 262 or
    higher
    + Test class ordering
    + @TempDir can be used to create multiple temporary
    directories
    + Extension registration via @ExtendWith on fields and
    parameters
    + Auto-close support for arguments in @ParameterizedTest
    methods
- Fix the classpath of console application so that it actually
  works</changelog>
</package>
<package pkgid="1fb3e4f2f584ed2891de55108a6e76a75d1b9e6b27e943164dc909418935a339" name="junit5-guide" arch="noarch">
  <version epoch="0" ver="5.8.2" rel="150200.3.6.1"/>
  <changelog author="fstrba@suse.com" date="1554984000">- Initial packaging of junit5 5.4.0</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to junit5 5.5.2
- Distribute also the manifest-only junit-jupiter artifact
- Build the console by default, since picocli package exists now</changelog>
  <changelog author="fstrba@suse.com" date="1646308800">- Package also the bill-of-materials pom</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Update to upstream version 5.8.2
  * Fixes:
    + Text blocks in @CsvSource are treated like CSV files
    + CSV headers in display names for @CsvSource and
    @CsvFileSource
    + Custom quote character support in @CsvSource and
    @CsvFileSource
    + Support for text blocks in @CsvSource
    + Java 18 support in the JRE enum
    + Access to the ExecutionMode in the ExtensionContext
    + Declarative test suites via @Suite classes
    + LauncherSession and accompanying listener
    + New UniqueIdTrackingListener
    + More fine-grained Java Flight Recorder events
    + Java Flight Recorder support on Java 8 Update 262 or
    higher
    + Test class ordering
    + @TempDir can be used to create multiple temporary
    directories
    + Extension registration via @ExtendWith on fields and
    parameters
    + Auto-close support for arguments in @ParameterizedTest
    methods
- Fix the classpath of console application so that it actually
  works</changelog>
</package>
<package pkgid="ee71f3762d8ec69df14243a5eca7ec200fbbf8b6f728d2e00adb4bd81f19bcb5" name="junit5-javadoc" arch="noarch">
  <version epoch="0" ver="5.8.2" rel="150200.3.6.1"/>
  <changelog author="fstrba@suse.com" date="1554984000">- Initial packaging of junit5 5.4.0</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to junit5 5.5.2
- Distribute also the manifest-only junit-jupiter artifact
- Build the console by default, since picocli package exists now</changelog>
  <changelog author="fstrba@suse.com" date="1646308800">- Package also the bill-of-materials pom</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Update to upstream version 5.8.2
  * Fixes:
    + Text blocks in @CsvSource are treated like CSV files
    + CSV headers in display names for @CsvSource and
    @CsvFileSource
    + Custom quote character support in @CsvSource and
    @CsvFileSource
    + Support for text blocks in @CsvSource
    + Java 18 support in the JRE enum
    + Access to the ExecutionMode in the ExtensionContext
    + Declarative test suites via @Suite classes
    + LauncherSession and accompanying listener
    + New UniqueIdTrackingListener
    + More fine-grained Java Flight Recorder events
    + Java Flight Recorder support on Java 8 Update 262 or
    higher
    + Test class ordering
    + @TempDir can be used to create multiple temporary
    directories
    + Extension registration via @ExtendWith on fields and
    parameters
    + Auto-close support for arguments in @ParameterizedTest
    methods
- Fix the classpath of console application so that it actually
  works</changelog>
</package>
<package pkgid="dd458da78c6c2e68a3fce7c2e33c008b57733dac18d699d9992727d6dd035dea" name="libMagick++-7_Q16HDRI5-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="e149db32e0eb6c2bb431be940a10f353a12e3d8794c7508d8b19c9d2d012e165" name="libMagick++-7_Q16HDRI5" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="7e12089e016a88c05bd78f10bdb3a69c5e9447f653ec413ed71e1e524deb450a" name="libMagick++-7_Q16HDRI5" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="ddeec1e01e941bb05b6169ff36dc806f98060aa7d9da34053321dac20851a55d" name="libMagick++-7_Q16HDRI5" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="1a9b3036e884c7588c722c16a60faea14abf4dfc36179e35f76345a7fd1f6204" name="libMagick++-7_Q16HDRI5" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="1fcd94ee3979c6b17b2b713b0eaa04ecebff9b0497300c2887a0873352d25e00" name="libMagick++-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="21059ef656da9d2c95a154128c22dd3bc94df45749fb10876b07456196254a04" name="libMagick++-devel" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="430a6d308fd0cd1ec496b3ff54bdc1f4bd90d5f7d14c4ccec2567a2e786a042c" name="libMagick++-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="f7e46a5b88885e5caaf5e2a9a63ca523fb34a5360856a07fd2bc5c8b9b16bd93" name="libMagick++-devel" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="d200cbfce851364ef81b9caa105f9e6c84ed133150a0e776189c022c266fecea" name="libMagick++-devel" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="97f13f432bb058e6f08ca0cbf5b76765d7800a599334d6f0bf096eb1f8b888cc" name="libMagickCore-7_Q16HDRI10-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="30ef2873c045e3e842a4bb035e9790c47cd35e1d6dae8cb249d4a5bcc9589c2b" name="libMagickCore-7_Q16HDRI10" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="abec5aced902483ea0209de2ccca791204c50fd39c987709be60691d72d676ff" name="libMagickCore-7_Q16HDRI10" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="cf3d7d282e8dad480c1c23e50593711cd13e0eedf787746883e65495670c701f" name="libMagickCore-7_Q16HDRI10" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="11666286483a63e53770aa4e972937a21593d53f86ffc85a4d7a523e964605a0" name="libMagickCore-7_Q16HDRI10" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="67a4bd0d63339487809ba50a8ba12f772fd55d809f8cab0a8199e1cdbf889b49" name="libMagickWand-7_Q16HDRI10-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="8aa3e03ebad5ba182081271a977b3ea0f8a5ef11fc44fc8c20b4927b67749ace" name="libMagickWand-7_Q16HDRI10" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="d13bd16c9c88dd77da68ca457f8a886fcafb176561773f4086a0b59db340d7e5" name="libMagickWand-7_Q16HDRI10" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="24065d1dc459690df286685bc2236cc9cb114d8863db3ea98303153a73a164cb" name="libMagickWand-7_Q16HDRI10" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="39986f6544f5e546dd07a4a804a1b1cb8a2765b623b96f7962f0fb11230bb5d0" name="libMagickWand-7_Q16HDRI10" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="b36bcdc929b110141e1de47100b5299c5ce3a10e4dab37020efd09c416cc0a96" name="libcares2" arch="aarch64">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="10424f2a08af81c2d48bb8826ffe6b890ba74658c0f76d45bf3524de7014c59f" name="libcares2" arch="ppc64le">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="b9975188055a6a5eaa289c1aa142c2f6564644f74c92fdb4749642eb73da49cf" name="libcares2" arch="s390x">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="6d36384bb2347feb6e1a36c5ecb794ffa36c47e915e335a4c11899c738ea4fda" name="libcares2" arch="x86_64">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="33c7eff8d4809579c5dd31aa15e76e96b8db4f76e91a23efea89b61b131eed7b" name="libcares2-32bit" arch="x86_64">
  <version epoch="0" ver="1.19.1" rel="150000.3.23.1"/>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
  <changelog author="adam.majer@suse.de" date="1684756800">- Update to version 1.19.1
  Security:
  * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
    (bsc#1211604)
  * CVE-2023-31147 Moderate. Insufficient randomness in generation
    of DNS query IDs (bsc#1211605)
  * CVE-2023-31130. Moderate. Buffer Underwrite in
    ares_inet_net_pton() (bsc#1211606)
  * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
    during cross compilation (bsc#1211607)
  Bug fixes:
  * Fix uninitialized memory warning in test
  * ares_getaddrinfo() should allow a port of 0
  * Fix memory leak in ares_send() on error
  * Fix comment style in ares_data.h
  * Fix typo in ares_init_options.3
  * Sync ax_pthread.m4 with upstream
  * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support</changelog>
</package>
<package pkgid="d52105a97c3df76d9e2368371d9c48a4212affe4c5fcaee21f0db615997a27f7" name="libcups2" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="365e0dd44325e0b4ab77fdb1b12a9b6e1e9a56ba20c6dc6f1d6b41e845499730" name="libcups2" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="bee2fb4c6dfa30c58e2d79e4810229a5081e410de7fffb19398f88b5606d53a9" name="libcups2" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="52107b8f76a0db6a33611457f2e08a15b3559e6fc9e2ab4d7ab3c7284899b138" name="libcups2" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="3fd5ade212d6e981e04d13feee81ea703e81bfa152f04b9e987bb5dddd68d3e9" name="libcups2-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="0d9be10a1c4a17037845e2a7ef39f6a37e5a19e26abbe092b513b1ce0856f250" name="libcupscgi1" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="a45396b0c90299b97f08cb7d83f74228d1f68af7568d3a563ff148760117fc41" name="libcupscgi1" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="cf4d23e2405d8f1e648daebb13fd7fd5dadb51d878fcb9147b8f7adb44f0a086" name="libcupscgi1" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="df986e401de28223bae9f95551cd403a26ae0ee19d6a546810e360dfa4f8e48d" name="libcupscgi1" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="bdcf418f11c1d2bd07f8602280fc19b3b51e7eedb2155d2a6903f050c1ba06dc" name="libcupscgi1-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="4ec9817771c8091722e702c41bb1608ed4b529960af908b93307131e40e7025c" name="libcupsimage2" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="4927f369a6f8225ebfbe427ea4a25fc5a408e343db94a1d28065418e2868a9de" name="libcupsimage2" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="b46c3cf5e34cd2f3b9220ce8ac52b3a5a8a92ac1c037dc58c0701d1da85995a9" name="libcupsimage2" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="b3186344e5e9faea2cd3bc13502fdf1263589af0e448c8851a30e8652e65115c" name="libcupsimage2" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="03cc75234f66dfbc6a6e7e90952130b39a2c7ed5d5ededf9be06059ee54e2c0b" name="libcupsimage2-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="3fa0b055cc663ca1fe090954a5546962177c578181197774b816d5662e426871" name="libcupsmime1" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="2799896c59443e70506bffd06852bf68c0395c72ca7798c77488e013bc9a651d" name="libcupsmime1" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="91d43e49dbe91ef1ffedca29002834769840fbbd9deb72d23372c45da0aeace7" name="libcupsmime1" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="2220e3cd73ee65be72a746fccc3c9bada3039b02d420c07e4b4b55eb562f4dc4" name="libcupsmime1" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="b71582d6028c2e22d2721021076646bae329736eb110583ccd4c2ecb3de5bd8d" name="libcupsmime1-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="7ab2162e22f36db32749c7b1962ff6aed32fe44aab55e7c440353f1e0e81ebc9" name="libcupsppdc1" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="7303c4610be503434767be37dac3dbe1263fbc9c3433ac873009fae1f36fd430" name="libcupsppdc1" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="97e7353588a3e8642f3cf3a56dae6d1685723ec1251fbb1f803bce14342bb802" name="libcupsppdc1" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="ee468b506572a8bcaaf5f3b082371815daf0b40e73f39377d9729dd8dad3cdb5" name="libcupsppdc1" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="ee72f7e3fea560b962f347ad22f1a6cd9b5192c1204627a0f230e13921169eb3" name="libcupsppdc1-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.43.1"/>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
</package>
<package pkgid="93f702e57e8e9e2c4af52336b3cfaf4a98c749b0037f39e101ac5a9685a72d98" name="libfrr0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="b3f5cce19d97f28657f31f4862425e2fb6b8e12bd8754e6bcb67332b7a0f39eb" name="libfrr0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="5f098b4d304bd8b08b353f0f5a91e99c20c1f4d73e7e2ed27340dbcf378585af" name="libfrr0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="e2db4be401087ea1dfd01e2a9b4869c232ce5587833d3f2033cb13949100979e" name="libfrr0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="01b2d9c51cdeb45f0d8491aeb6ac9cfe7930c85295a7fe1b929412f06202feff" name="libfrr_pb0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="ed75d2a041982ffe50d9d3fca995c5feac4d76537ab653c2477ff161055a1a66" name="libfrr_pb0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="5b8b90cc18319e186f25004042f21fa5a345da4d5db748eefe03edb078865260" name="libfrr_pb0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="2823c736c7d7d4c5af05d6a6b67784a44f91548bde3567fb3256f35811783966" name="libfrr_pb0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="804390c0ad4f63693ae1252c6dc2525818620f401cd7663c2d9d720d8a7cbafe" name="libfrrcares0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="db370ad5bd16862e2a7e667215c4d821604aa6373937a198a5e2f06ca9877f68" name="libfrrcares0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="61dd09c7c81f395db62d5a9f00e1e3feb9629b59fb3145625ff291a1087e7080" name="libfrrcares0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="4167a85469564118fd38d95aad0bf6e48f3e8f3c178486ee3c92fe99baee7c55" name="libfrrcares0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="8c9af9d795879c7ad3d28d7d66dcf2e66c10a3e027152e368c16015fdea8b2ac" name="libfrrfpm_pb0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="7e65b1e001e256372ea0fa180eeb46ee8c969eb615ea1ffd4b27f9578efe06f9" name="libfrrfpm_pb0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="c7bb588791431cfb973c1d82270bf15b3d29fe882fdcec6846bb62d0ed53816d" name="libfrrfpm_pb0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="334d545fa060fd70d4dfdcef3fd63a6c1f9dd244e1a59f21ee8d4cb7fbbcb628" name="libfrrfpm_pb0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="8d924b095f55f5f7405a5e60c70c34f999463105d737faa5d183f6b4216cedc8" name="libfrrospfapiclient0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="9093794f93ade2bb43a91f01d30669f670804e3443e55d0f7adc1738a5b9d2f2" name="libfrrospfapiclient0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="f661ec90fbb1109248efb4ffe0fb21b9b846120d0497c490bc480163c408a364" name="libfrrospfapiclient0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="2bfbb2b759aed651a7d4ffd6d35be8f22ac0c8445b38483aa4ac8dfd3d1413a0" name="libfrrospfapiclient0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="64fa7fb40db340955bb9129ab00c21b3ab4e9c200c109ae963300828e2f93f1c" name="libfrrsnmp0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="0b407966c38f123cb6ebdaa77612260a82bdec3f8ed0708ca96b07ff07f715ac" name="libfrrsnmp0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="3cfe27f3131f66d0be993c345348fa7128dacd1eaf7c9f400706eab155eeb720" name="libfrrsnmp0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="c1b856f9aa2db6eab67747ad31ec8c317fb48155ecaa4417bd12ffc15b11d728" name="libfrrsnmp0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="859b6aa886e7ca33a3ba10e26c1d907f68b647887df3d4d2ba6c46239f48a1a8" name="libfrrzmq0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="eb841941ab77d822fbd38a9695f57fbc63c79c91d7a5a0136faf55b5a23138be" name="libfrrzmq0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="1cc70b81d5cff507e66ae0f9e10e9c0923608d34aa624c9e7de0af355727f5c9" name="libfrrzmq0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="b87aea6d80455ea2c0e2d664dbdf93abb998009aa820e47f6d6f2c81cd898592" name="libfrrzmq0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="f72e13e15de34609442a4bbede5f2b3cc06da9daa2d1cc41cc9755267b7f1c02" name="libldap-2_4-2" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="b0248b61e57a158917a5381861db3881a5d6c736174a0520dca2c632b3686ba8" name="libldap-2_4-2" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="5c39e355d6aaf6e70b238779f36845916638546f099fe1f462645c797073ce9f" name="libldap-2_4-2" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="e65f3bdd8cd68295e244024aec80a7d49343c651c24fa8985394b62902b3af19" name="libldap-2_4-2" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="8b56c9968b5fb156afe40e80f0ded34f593962a5cfe77adb46e9cd82f5683d17" name="libldap-2_4-2-32bit" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="1c1f6e5f07d78dde0216b6e0cf5d1f1d1c39e8c58045a758e8537461a99d0da8" name="libldap-data" arch="noarch">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="76464114f7192406b61e4e2f78900bce6a6b80322f4262185d412d72e0d6b5e4" name="libmariadbd-devel" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="d2a8c6cc626ff365f717573893172902e8b6db7415656d7fac6d0aa82318e0d2" name="libmariadbd-devel" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="40b00f149ab13877ab736600b04e187ff63d922d0759b270be4f19c192129d79" name="libmariadbd-devel" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="f0534fc75da056962b9fa0fe5f9235a2d2630c0059969fd63237a23b03c8139c" name="libmariadbd-devel" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="6dd3550a8c38525090285a5f1fed2b06d27523b237d9ac5e7a749f9182803725" name="libmariadbd19" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="d5d4815085b641db011f36341fd100ec5d2074c0b2ecaec140f8de65794a8c64" name="libmariadbd19" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="2562ebbd2c39a39e22eca25e346f594c141811eb359993a74d480ab956e78618" name="libmariadbd19" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="80ed73465b4e27e5e24c4d47292d71287daccfae01624206ca9b4d3482d0921a" name="libmariadbd19" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="783e07da67b320b4dc4b0799fab354b388c96c5fbd1ee5504bf68623e4ab4b5e" name="libmlag_pb0" arch="aarch64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="8aa71ab63909253d92973ea0ebe8c9bc10a9860bcff15734e53ab2d64ad3ab55" name="libmlag_pb0" arch="ppc64le">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="49397a6b003ecfa25e6b8297fe334ebd7c63cfdc605179e3bac394af6d3b5a3a" name="libmlag_pb0" arch="s390x">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="d7df0856533728988a514f155caffe78850ffb6a7c3e88f1d2782333cf5ecc93" name="libmlag_pb0" arch="x86_64">
  <version epoch="0" ver="8.4" rel="150500.4.3.1"/>
  <changelog author="mardnh@gmx.de" date="1588766400">- Update to version 7.3.1
  Bugfix/maintenance release
  * Upstream does not provide a changelog</changelog>
  <changelog author="erico.mendonca@suse.com" date="1590926400">- 0001-build-use-configfile-mode-in-init-script.patch: Fix CVE-2020-12831 (boo#1171658).</changelog>
  <changelog author="mardnh@gmx.de" date="1593604800">- Update to version 7.4
  * Upstream does not provide a changelog
- Drop patch (fixed upstream):
  * 0001-build-use-configfile-mode-in-init-script.patch</changelog>
  <changelog author="mt@suse.com" date="1601640000">- add build condition disabling mininet build require by default,
  needed by the optional topology tests.
- removed one occurrence of vrrpd binary listed twice in file list</changelog>
  <changelog author="mardnh@gmx.de" date="1604491200">- Update to version 7.5
  * Upstream does not provide a changelog
- Make grpc support optional and don't enable it by default</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1608638400">- Disable ZeroMQ tests due to sporadic timeouts during package builds (bsc#1180217)
  [+ 0001-disable-zmq-test.patch]</changelog>
  <changelog author="olaf@aepfle.de" date="1610107200">- Requires libyang 1.0.184</changelog>
  <changelog author="mardnh@gmx.de" date="1614859200">- Update to version 7.5.1
  * Maintenance release
    See: https://github.com/FRRouting/frr/blob/stable/7.5/changelog-auto.in</changelog>
  <changelog author="mt@suse.com" date="1619179200">- Use skip, not xfail in 0001-disable-zmq-test.patch to disable
  zmq test as it is not expected to fail but hangs (bsc#1180217)</changelog>
  <changelog author="jsegitz@suse.com" date="1631793600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_frr.service.patch</changelog>
  <changelog author="linnaea@lavia.moe" date="1633780800">- Update to version 8.0.1
  * refreshed patch:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  * LDP gained SNMP support
  * OSPFv3 gained VRF support
  * EVPN Multihoming is now fully supported
  * TI-LFA implemented in IS-IS and OSPS
  * New Segment Routing daemon
  * See: https://frrouting.org/release/8.0/
    and https://github.com/FRRouting/frr/releases/tag/frr-8.0.1</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="linnaea@lavia.moe" date="1637150400">- Update to version 8.1
  * Graceful Restart for OSPFv2 and OSPFv3
  * OSPFv3 NSSA and NSSA-TSA support
  * OSPFv3 ASBR Summarisation Support
  * BGP SRv6 and Prefix-SID Type 5 improvements
  * BGP EVPN type-5 gateway IP overlay Index
  * Lua hook support
  * See: https://frrouting.org/release/8.1/</changelog>
  <changelog author="jsegitz@suse.com" date="1639051200">- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).</changelog>
  <changelog author="mt@suse.com" date="1646049600">- Apply fix for a buffer overflow in isisd due to the use of strdup
  with a non-zero-terminated binary string (bsc#1196506,CVE-2022-26126)
  [+ 0006-isisd-fix-10505-using-base64-encoding.patch]
- Apply fix for a buffer overflow in isisd due to wrong checks on
  the input packet length (bsc#1196505,CVE-2022-26125) with workaround
  for the GIT binary patch to tests/isisd/test_fuzz_isis_tlv_tests.h.gz
  [+ 0005-isisd-fix-router-capability-TLV-parsing-issues.patch]
- Apply fix for a buffer overflow in babeld due to wrong checks on
  the input packet length in the packet_examin and subtlv parsing
  (bsc#1196504,bsc#1196507,CVE-2022-26128,CVE-2022-26129)
  [+ 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch]
- Apply fix for a heap buffer overflow in babeld due to missing check
  on the input packet length (bsc#1196503,CVE-2022-26127)
  [+ 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch]</changelog>
  <changelog author="dimstar@opensuse.org" date="1647518400">- Make build a bit cheaper: do only BuildRequire the primary python
  interpreter and its modules (python3-FOO) instead of all
  available versions as done using %{python_module FOO}</changelog>
  <changelog author="mt@suse.com" date="1662379200">- Apply upstream fix for out-of-bounds read in the BGP daemon
  that may lead to information disclosure or denial of service
  (bsc#1202023,CVE-2022-37032)
  [+ 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch]
- Apply upstream fix for a memory leak in the IS-IS daemon that
  may lead to server memory exhaustion (bsc#1202022,CVE-2019-25074)
  [+ 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]</changelog>
  <changelog author="mt@suse.com" date="1668168000">- Migration to /usr/etc: Conditionally moved /etc/logrotate.d/frr
  file to vendor specific directory /usr/etc/logrotate.d and added
  saving of user changed configuration files in /etc and restoring
  them while an RPM update.
- Declare root as sufficient also in the pam account verification;
  without vtysh use causes to log a pam frr:account warnings
  (https://github.com/FRRouting/frr/pull/12308)
  [+ 0005-root-ok-in-account-frr.pam.patch]
- Applied fix removing a not needed backslash causing to log a warning
  (https://github.com/FRRouting/frr/pull/12307)
  [+ 0004-tools-remove-backslash-from-declare-check-regex.patch]
- Applied upstream fixes for frrinit.sh to avoid a privilege escalation
  from frr to root in frr config creation (bsc#1204124,CVE-2022-42917,
  https://github.com/FRRouting/frr/pull/12157).
  [+ 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch]
- Removed obsolete patches provided in the 8.4 source archive:
  [- 0003-babeld-fix-10487-by-adding-a-check-on-packet-length.patch,
  - 0004-babeld-fix-10502-10503-by-repairing-the-checks-on-le.patch,
  - 0005-isisd-fix-router-capability-TLV-parsing-issues.patch,
  - 0006-isisd-fix-10505-using-base64-encoding.patch,
  - 0007-bgpd-Make-sure-hdr-length-is-at-a-minimum-of-what-is.patch,
  - 0008-isisd-Ensure-rcap-is-freed-in-error-case.patch]
- Update to version 8.4, see https://frrouting.org/release/8.4/
  * New BGP command (neighbor PEER soo) to configure SoO to prevent
    routing loops and suboptimal routing on dual-homed sites.
  * Command debug bgp allow-martian replaced to bgp allow-martian-nexthop
    because previously we allowed using martian next-hops when debug is
    turned on.
  * Implement BGP Prefix Origin Validation State Extended Community rfc8097
  * Implement Route Leak Prevention and Detection Using Roles in UPDATE
    and OPEN Messages rfc9234
  * BMP L3VPN support
  * PIMv6 support
  * MLD support
  * New command to enable using reserved IPv4 ranges as normal addresses
    for BGP next-hops, interface addresses, etc.
  * As usual, lots of bugs and memory leaks were fixed \m/
    such as a fix for a possible use-after-free due to a race
    condition related to bgp_notify_send_with_data() and
    bgp_process_packet() in bgp_packet.c. This could lead to
    Remote Code Execution or Information Disclosure by sending
    crafted BGP packets (CVE-2022-37035,bsc#1202085).
- Update to version 8.3, see https://frrouting.org/release/8.3/
  * Notification Message support for BGP Graceful Restart
  * BGP Cease Notification Subcode For BFD
  * Send Hold Timer for BGP
  * RFC5424 syslog support
  * PIM passive command
- Update to version 8.2.2, see https://frrouting.org/release/8.2.2/
  * BGP Long-lived graceful restart capability
  * BGP Extended Optional Parameters Length for BGP OPEN Message
  * BGP Extended BGP Administrative Shutdown Communication
  * IS-IS Link State Traffic Engineering support
  * OSPFv3 Support for NSSA Type-7 address ranges
  * PBR VLAN actions support</changelog>
  <changelog author="mt@suse.com" date="1680523200">- Enable pim6d providing PIMv6 support (bsc#1206234)</changelog>
  <changelog author="mt@suse.com" date="1684152000">- Apply upstream fix for denial of service via the bgp_capability_llgr()
  function (bsc#1211248,CVE-2023-31489,gh#FRRouting/frr#13098).
  [+ 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch]
- Apply upstream fix for denial of service via the bgp_attr_psid_sub()
  function (bsc#1211249,CVE-2023-31490,gh#FRRouting/frr#13099).
  [+ 0007-bgpd-Ensure-stream-received-has-enough-data.patch]</changelog>
</package>
<package pkgid="0bdde40c10e6816f7eacc91c66428481cf5de92530041b1721852518a18058bc" name="libnvme" arch="src">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="e8b50d85579f85426d52851b84e0347b8d2232e0a4bbc4e613d54344553bca9b" name="libnvme-devel" arch="aarch64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="452e560141af9149534a50cbc41b55dd4661371599d02dfcfad155d553e2ff92" name="libnvme-devel" arch="ppc64le">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="b3f7868411028aa7a095e32fa1129c2e1cfdfc5823370a4c9628d0e38d896bef" name="libnvme-devel" arch="s390x">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="b326606dad877f08be7ff6b970d9a07756780a74044ee48ce854bf8329d78d6a" name="libnvme-devel" arch="x86_64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="5b0e8ad4530960feebd92e0f8135cbd4c95764f19b33e8cc48ff554d964aaad9" name="libnvme-mi1" arch="aarch64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="9f78529a795597684ee26e7c25d272463a423218c34d72700c4549759e980ae0" name="libnvme-mi1" arch="ppc64le">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="d33aa8606061114a17128868584bbc74a39edcbed7dbd9b4d1624373d9604d20" name="libnvme-mi1" arch="s390x">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="7cd747351d27e56f1f67f93378cb122967643069e97d66d08766dc8d920f4ad2" name="libnvme-mi1" arch="x86_64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="eaf40cb3b719472180266cd61f54b924c5dec51b3e832857678e2cd49454474c" name="libnvme1" arch="aarch64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="30338c083cd27b848791ad1f7de5533cee4f227c9be1e2ac6cc02496d8d78c6b" name="libnvme1" arch="ppc64le">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="dccffca6883777f3e8ee71f1d33113a69e2aa60a66ec6012ad99386d2f843939" name="libnvme1" arch="s390x">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="e3ee4321656e7514b0f8c1a2782fd103043b5c92e59431630a293ffac91b495a" name="libnvme1" arch="x86_64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="4aec16565f007301cbee2c7d817de30e5af31b2cc8df6cc94dce6efbe1cf3a0e" name="libopenssl-1_0_0-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="a1a7de312aa06ef8e8e74bb4a0089a054b76c8edd10a71f9c533a752178fef45" name="libopenssl-1_0_0-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="cf8736483f26ab8cc8a856da302c3aa65be9fe81cce957549b77499c6fb56319" name="libopenssl-1_0_0-devel" arch="s390x">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="50e277effae8dbdd95cd25d962d8f7f11682f74987c029819396cb73915c91b2" name="libopenssl-1_0_0-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="21391c15c65364bf83deffeecef47bc39a60678a531cd4ee4a9acb650486950b" name="libopenssl-1_0_0-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="76caffaf9812a227c720c3db134e9e19da54db0193aa31886595557f29a13160" name="libopenssl10" arch="aarch64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="131bf710aab8adb6544510817c71ca8415e812798817ea1a1581c737089eb1fb" name="libopenssl10" arch="ppc64le">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="8b7f0055c29c6e19e82e608e339b3f7cd469483de3c2093d4be0867de72ad4d8" name="libopenssl10" arch="s390x">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="594ef14dc73ab0b509624910ba5d1143790053ce123b887944143db544bd90a2" name="libopenssl10" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="a3724f25b5bfd0d9d78fb370178d261380a1619bc974875c3e4866e9930f3484" name="libopenssl1_0_0" arch="aarch64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="2612fbf4a6cce45098204449cd2f5c9ad6a81cc1f84793b1ca3009a7f99f8f8d" name="libopenssl1_0_0" arch="ppc64le">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="d7730429f939ce1273bbc92ab9266a9df3b1e9a6b1eebca8a7c7f83d870dd60c" name="libopenssl1_0_0" arch="s390x">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="40ab7b8404f7c549a34432f1277bfe2a4f7e1fbdcbf153989e5064b81ac93919" name="libopenssl1_0_0" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="4f949aec0b4d1aa3be558947c671608080c595fe226eb9d3fb011f2c94a9b50d" name="libopenssl1_0_0-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="3e26bd215f4f58b9089e42c84c2dbb15dfe7d2eaf13df07b36e06b17932ebade" name="libopenssl1_0_0-hmac" arch="aarch64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="28f59d6e89525d50db3a11bc31b6c7b8456cd0b8d8052a4d66484219c15feb98" name="libopenssl1_0_0-hmac" arch="ppc64le">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="bb6e0559bb1e678b319e2fff6c7bf1c9d53be68567d6eb962dd7d66817a6af14" name="libopenssl1_0_0-hmac" arch="s390x">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="43e68e19fd78372820572ee49b6030ac91e48c30b6fe97e92e051edceeaf3561" name="libopenssl1_0_0-hmac" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="572d23e4b3acc1eefb1a73ebd5fdb8d28875bd3238619d3f61f14b77996e1094" name="libopenssl1_0_0-hmac-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="86e6c5e661f028ec20e6a224872a493921ea5ffe256a2097ed3054d101433b27" name="libopenssl1_0_0-steam" arch="aarch64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="eff23c650a139c0c3b7ddce103391d3c401594b927582d59e045af3aeabb066d" name="libopenssl1_0_0-steam" arch="ppc64le">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="847a5a4c9d178151506931b4f5d9c2b573a3ed73240d9be49977420f93876efc" name="libopenssl1_0_0-steam" arch="s390x">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="4916fe7c12165b36b4237f6839698d63eeda77d304ae65c8b5ce71f3a5e10fa4" name="libopenssl1_0_0-steam" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="bae18df4a3060ac1eba6fe238233d49d6ab4f1c787cdad24075878e75c2fe39d" name="libopenssl1_0_0-steam-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="e6b68430717d90f200f102133f71867bfca71e0e9d3c7b136a4541e06ddaf919" name="libopenvswitch-2_14-0" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="f7c8e4902707a4f6ae49cdea692432d982efabae1dfaff5c30800293952188cf" name="libopenvswitch-2_14-0" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="f170bcdb28e456040640016de09dd88752b2aa53ba6653220fcaa83df7e19606" name="libopenvswitch-2_14-0" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="e95c6ff687a811c59ab1ef270b9d8b34f78385afc087483b7bb460940fc9a4d9" name="libopenvswitch-2_14-0" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="1b34a797c10dbcb622d3430f35d38b3bddbd0122e3c89beb63207ce3226e4f1f" name="libovn-20_06-0" arch="aarch64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="98ed768a20b62e043e7c766fb5af94f7fb780c174af72274ef05888d64f805ed" name="libovn-20_06-0" arch="ppc64le">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="938098b4d56bc03807ca7df4a3768622beefd011ed4f1205492113526ced74bf" name="libovn-20_06-0" arch="s390x">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="5a28e759d172b47b0ab73b8308aeebad2168278f1af980c4edf82ef954530beb" name="libovn-20_06-0" arch="x86_64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="583b8df9d7fb51267e12e80c460743b0ef9c3ddbf29f288fbf77a7e2ab1a3a27" name="libpython3_10-1_0" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="f3224bea626910c98a653b6ac1e3642d7d74d26d48f8b0665cfaa7fccaea2f4e" name="libpython3_10-1_0" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="9c38ef78624e88a4c1cae38558f84c25ffdd4d34efb77c66d4693054cb39b0e2" name="libpython3_10-1_0" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="f0f049695a3a9548cb9f0b6a8b47f69035dbdeb9fa8fadce0e85ba214aa61efe" name="libpython3_10-1_0" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="96baee89f9148bdd68787d9dd82a1ff1d0d50c77a9e3dbcfca9fa5eeba11417b" name="libpython3_10-1_0-32bit" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="5164c151b5de2232be31aa9d6c78f4b7bcbdb9d5899bfef7e102edad4e7aff59" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="4436fcf74ca826459fd7e8b06f028f356426a4e251ef576359fef1cf09c8ccca" name="libpython3_6m1_0" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="dcda3addd227f44a75c633b169a69b5f45957c2b570efbb6e9ea9a571eb712ff" name="libpython3_6m1_0" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="bff1a5797066d946f9090f57299b621ba660557d43b9c2a0c31f39d6df4dbf2d" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="defc1816600c945e91bb2b79f29161cc20f1b40b7734fc7e6eb0f0dbba0ff3f3" name="libpython3_6m1_0-32bit" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="f412f7242f97835b4542b01cea6df1b4af2adaa213e53cdb0687359f19d191b9" name="libsolv" arch="src">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="539178b3a1abef5342c0165b67eb6dc130fb8075bbb885e682311e828d3ff3dc" name="libsolv-demo" arch="aarch64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="832a767f88692ffe006c88ea839e9d64ddf9fc0e8274199914a70ed3dd9c9121" name="libsolv-demo" arch="ppc64le">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="392576d0d0cbacffb53b346072a08716d2712dfd835e8a36edea473260275e44" name="libsolv-demo" arch="s390x">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="1e79046ab2986608576b1523f9666830dab025c09b16a1b443a730bdff24309e" name="libsolv-demo" arch="x86_64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="ddd90c80873f270d09d60776a671090e95df25a7fc82641ccf8daa73dd75cff5" name="libsolv-devel" arch="aarch64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="8d235e5172f24058b8ddeeda66f9695930cbb5f77b8bdab8c3b0c3430107e824" name="libsolv-devel" arch="ppc64le">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="0b485cbdffacd6e7903e6929240fe936530bce29a56d8dabb8288762f82ea68d" name="libsolv-devel" arch="s390x">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="f64ea0ec223288a6a8f39b2dc18b6d38768bbd624cd216bbfabb1652f98425f5" name="libsolv-devel" arch="x86_64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="d2e7e89c6e6cb80b789eda59041bebef3b00a8f22463d8e4bfc0329a2608a028" name="libsolv-tools" arch="aarch64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="d05608e8ace92f76c0e00041bfc10dbdb91684bc8037df4184ba05d949c1ac76" name="libsolv-tools" arch="ppc64le">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="8802942eba908792ff54d4d280c75060c0f7b0e4aab2022a6edeead43e135ca0" name="libsolv-tools" arch="s390x">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="f85c7e284958c305634a6f5cae0c354def2fcd4c34ae0c5e0d24e9cbe7ee8a3e" name="libsolv-tools" arch="x86_64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="e41742a9ee32cbdc6644a07eeb715fbeb602e82ed9714aebd8fcfcc5d85d8cba" name="libtiff-devel-32bit" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="06cf6b86faa4ba9056fa6d13f258d07059b65c1caa100df31c15257651aa9784" name="libtiff-devel" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="d9df753c76c3473c4e3b78f1337158e8d29ca3ce327343a173fbc9e3cc5f5aa7" name="libtiff-devel" arch="ppc64le">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="58811326a29c77c2fc89e7f1d844c59a1c900fcaa452fc4ba3f494c106a87c1f" name="libtiff-devel" arch="s390x">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="1dc6b38162f4344ce8eb66bf0ec51759035a106001946fabe342eb29a3ae006f" name="libtiff-devel" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="238f665bae86cdc52b8d64a939f5a59ac0233366e2559c3a39103943a13ecb58" name="libtiff5-32bit" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="ca2b7a2b635686e70f9b3f3fe61c762c3fbbdce21c8985da9c094b264df48a94" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="492f1ca45efc233bb6263f04dfe85f9c9612bf612a6a003ba3738f5a80d0722b" name="libtiff5" arch="ppc64le">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="320e030ae83cd2f5fad7d6a9e5a09d061b83e630b093e420f3125d81a3756a58" name="libtiff5" arch="s390x">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="228558555f1ace0f24049bfdf1425b17d7128a576ff4a9c4848fc2c6045a605b" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="1b03d97d3503353e9e5c811b4663e75aacbca3a99f785f9df211b3fdce187023" name="libwebp" arch="src">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="jengelh@medozas.de" date="1327924800">- Rename webp-tools to libwebp-tools to follow scheme of other
  lib*-tools packages.</changelog>
  <changelog author="dimstar@opensuse.org" date="1346414400">- Update to version 0.2.0:
  * Add support for ARGB -&gt; YUVA conversion for lossless decoder
  * Add stats for lossless and alpha encoding
  * Security related hardening: allocation and size checks
  * Add PAM output support to dwebp
  * Alpha channel encode/decode support
  * Lossless encoder/decoder
  * Add TIFF input support to cwebp
  * Incompatible changes:
  - The encode ABI has been modified to support alpha encoding
  - Deprecated function WebPINew() has been removed
  - Decode function signatures have changed to consistently use
    size_t over int/uint32_t
  - decode_vp8.h is no longer installed system-wide
  - cwebp will encode the alpha channel if present.
  * Add libtiff-devel BuildRequires for the new tiff input support.
  * Rename libwebp2 subpackage to libwebp4 (by changing lname
  defines), following upstreams soname bump (incl. baselibs.conf).
  * No reason to run autogen</changelog>
  <changelog author="mailaender@opensuse.org" date="1355054400">- Update to version 0.2.1
  * libwebp: validate chunk size in ParseOptionalChunks
  * cwebp (windows): fix alpha image import on XP
  * autoconf/libwebp: enable dll builds for mingw
  * [cd]webp: always output windows errors
  * fix double to float conversion warning
  * cwebp: fix jpg encodes on XP
  * VP8LAllocateHistogramSet: fix overflow in size calculation
  * GetHistoBits: fix integer overflow
  * EncodeImageInternal: fix uninitialized free
  * fix the -g/O3 discrepancy for 32bit compile
  * fix the BITS=8 case
  * Make *InitSSE2() functions be empty on non-SSE2 platform
  * make *InitSSE2() functions be empty on non-SSE2 platform
  * make VP8DspInitNEON() public</changelog>
  <changelog author="jengelh@inai.de" date="1366113600">- Update to new upstream release 0.3.0
  * WebPINewRGB/WebPINewYUVA accept being passed a NULL output buffer
  and will perform auto-allocation.
  * Default filter option is now "-strong -f 60"
  * Encoding speed-up for lossy methods 3 to 6
  * Alpha encoding can be done in parallel to lossy using
  `cwebp -mt ...`
  * Color profile, metadata (XMP/EXIF) and animation support in the
  container was finalized.
  * Various NEON assembly additions
- Tool updates / additions:
  * gif2webp added
  * vwebp given color profile &amp; animation support
  * cwebp can preserve color profile / metadata with "-metadata"</changelog>
  <changelog author="jengelh@inai.de" date="1372248000">- Update to new upstream release 0.3.1
  * Add incremental decoding support for images containing
  ALPH and ICCP chunks.
- Enable libwebpmux, libwebpdemux</changelog>
  <changelog author="jengelh@inai.de" date="1389268800">- Update to new upstream release 0.4.0
  * improved gif2webp tool
  * numerous fixes, compression improvement and speed-up
  * dither option added to decoder (dwebp -dither 50 ...)
  * improved multi-threaded modes (-mt option)
  * improved filtering strength determination
  * BMP and TIFF format output added to 'dwebp'
  * Significant memory reduction for decoding lossy images with alpha.
  * Intertwined decoding of RGB and alpha for a shorter
  time-to-first-decoded-pixel.
  * WebPIterator has a new member 'has_alpha' denoting whether the
  frame contains transparency.
  * Container spec amended with new 'blending method' for animation.</changelog>
  <changelog author="jengelh@inai.de" date="1407758400">- Update to new upstream release 0.4.1
  * AArch64 (arm64) &amp; MIPS support/optimizations
  * NEON assembly additions: ~25% faster lossy decode/encode (-m 4);
  ~10% faster lossless decode;~5-10% faster lossless encode (-m 3/4)
  * dwebp/vwebp can read from stdin
  * cwebp/gif2webp can write to stdout
  * cwebp can read webp files; useful if storing sources as webp
  lossless</changelog>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="e6de12a90823e635797210c38d7048d513e48fc0b38172b237beef80d5f1e3cc" name="libwebp-devel" arch="aarch64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="929c4174ebdc40cfd267adbf12942601eff9b67e1c8b632b837001fe59eda6be" name="libwebp-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="9d0d5b7036e475ec61c6fc585da7c2f58ceca43698168c17f910d80af9a8cf43" name="libwebp-devel" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="bb3f48a5d8740e2004599814faf3b8fd68fe2a27e7c7f3d816a67b5dd8f7ad11" name="libwebp-devel" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="b35e3fa5a377cdfda567a87050ee66dc8d7939ad9044a162c0c4dcdaa970e131" name="libwebp-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="24e00499cb82d3a6a8804d0ddc2f3eb0557a9fdefaf474e2eaa39d8dec1a771b" name="libwebp-tools" arch="aarch64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="ec9c6719a3f09055afd98ab8785cee8748870e4af6bedbb661d626414e6d8b45" name="libwebp-tools" arch="ppc64le">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="7e4a6c2a81251ff2735f2f2cc7f1a233eaef82ff075561319a656b3ab5433187" name="libwebp-tools" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="3b7398946c91fbbc9f136f3da2ee86f35f19e67cc599c30be5f79d2963c70826" name="libwebp-tools" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="4bfb5c72c89a3b2c7a0917587e6fa5234238c56ef6dc86da48fc2806b28dbeb0" name="libwebp7" arch="aarch64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="63d7b2d9575583eb233c95e924b554e8f00f3be07c32330a5b17b8786cbbc085" name="libwebp7" arch="ppc64le">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="faf58f087d0ca971981cfca6d4dd70ee6f8d7fda7f0c94d07284eccd4fc82f8d" name="libwebp7" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="60299bfed3e360addbf055ffaccbb82b0e45bd0eff8d54f1dbaf89845548e831" name="libwebp7" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="b433548426fe0515eb9566b9c8b8c271b743c3667754434da48d61c5a613e747" name="libwebp7-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="dd399ee5ffee569f48f3b5a1de5a21e4c2cbc37db3fda8df9c9aa9cef3776ea0" name="libwebpdecoder3" arch="aarch64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="30c2d90460ecfec5d463454545ab86932fb775e888e5d838e759b30b6509e6c8" name="libwebpdecoder3" arch="ppc64le">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="91f2503fbd4cb3711e3c34524986de902efe6a2abfa4323debb715a3bb288b8f" name="libwebpdecoder3" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="545307b3d44b41d3714468c85188368ec7dd71f63f06501a23468c11fb072a9d" name="libwebpdecoder3" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="6842ae2c3a45cd282f6d73172a9513f1b863bde5e18cff6d99e79e524428cee6" name="libwebpdecoder3-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="f8d1594191ce182d1e6bc32b5659fcff13acfbb6acd4e88e30741b79192aaaf5" name="libwebpdemux2" arch="aarch64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="ab20a87b126c642aa858d526a3f16a53a21e85aa9cd77965e15916a8993aab1d" name="libwebpdemux2" arch="ppc64le">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="e7166f104085d764ac0c5df5e6ecf7a183f522ae2142867bf7bfb37c94846959" name="libwebpdemux2" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="1a377b33a547e86235a694cc52f82b705ac25ff4f44f1006e3bba1790ed4c4ef" name="libwebpdemux2" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="3ccbb1a81872dcfb1991c76eeec2e93314ecd615db4411068d2cf3fbd5398e36" name="libwebpdemux2-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="d3e0fa6f0f5b904aab9d885991ae962ebc37de5579442e7c8e44118ed0e0bc0d" name="libwebpmux3" arch="aarch64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="023488eae746d1d9530f175f9cac1e57a584fc1c5d5c25e3502f08d358111c59" name="libwebpmux3" arch="ppc64le">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="6c35a128592d39cad6b1e77715d6d05165d603046f8e2102ffe145d1d572b368" name="libwebpmux3" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="852bd79f29fcdef7a4fa98420dcf19d09806026d092a984805dd8921babbe316" name="libwebpmux3" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="f9bbf50064b0f10e505885450fc5d3f376bd900cd9fe0be2b9d574f236affed3" name="libwebpmux3-32bit" arch="x86_64">
  <version epoch="0" ver="1.0.3" rel="150200.3.5.1"/>
  <changelog author="dmueller@suse.com" date="1414497600">- update to 0.4.2:
  This is a binary compatible release.
  * Android / gcc build fixes
  * (Windows) fix reading from stdin and writing to stdout
  * gif2webp: miscellaneous fixes
  * fix 'alpha-leak' with lossy compression (issue #220)
  * the lossless bitstream spec has been amended to reflect the current code
- add aarch64-disable-neon.diff: work around compile failure with
  neon on aarch64.
- add libwebpdecoder1 subpackage</changelog>
  <changelog author="dimstar@opensuse.org" date="1414584000">- Update baselibs.conf: make it match the currently build library
  packages.</changelog>
  <changelog author="jengelh@inai.de" date="1427630400">- Update to new upstream release 0.4.3
  * lossless decode fix and a multi-threading fix
  * documentation / vwebp updates for animation</changelog>
  <changelog author="dmueller@suse.com" date="1434196800">- remove aarch64-disable-neon.diff: compiler was fixed, neon
  can be compiled now</changelog>
  <changelog author="jengelh@inai.de" date="1435579200">- Add libwebp-devel to baselibs.conf [bnc#936417]</changelog>
  <changelog author="p.drouand@gmail.com" date="1449576000">- Update to version 0.4.4
  * rescaling out-of-bounds read fix (issue #254)
  * various build fixes and improvements (issues #253, #259, #262, #267, #268)
  * container documentation update
  * gif2webp transparency fix (issue #245)
- Add freeglut-devel build requires</changelog>
  <changelog author="mpluskal@suse.com" date="1455192000">- Update to 0.5.0
  * miscellaneous bug &amp; build fixes (issues #234, #258, #274, #275,
    [#278])
  * encoder &amp; decoder speed-ups on x86/ARM/MIPS for lossy &amp;
    lossless
    + note! YUV-&gt;RGB conversion was sped-up, but the results will
    be slightly different from previous releases
  * various lossless encoder improvements
  * gif2webp improvements, -min_size option added
  * tools fully support input from stdin and output to stdout (issue
    [#168])
  * New WebPAnimEncoder API for creating animations
  * New WebPAnimDecoder API for decoding animations
  * other API changes:
    + libwebp:
    WebPPictureSmartARGBToYUVA() (-pre 4 in cwebp)
    WebPConfig::exact (-exact in cwebp; -alpha_cleanup is now the
    default)
    WebPConfig::near_lossless (-near_lossless in cwebp)
    WebPFree() (free'ing webp allocated memory in other
    languages)
    WebPConfigLosslessPreset()
    WebPMemoryWriterClear()
    + libwebpdemux: removed experimental fragment related fields
    and functions
    + libwebpmux: WebPMuxSetCanvasSize()
  * new libwebpextras library with some uncommon import functions:
    WebPImportGray/WebPImportRGB565/WebPImportRGB4444
- Make building more verbose</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Update baselibs.conf</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- update to 1.0.0
  - lossy encoder improvements to avoid chroma shifts in various
  - ircumstances (issues #308, #340)
  - big-endian fixes for decode, RGBA import and
    WebPPictureDistortion
  - Tool updates:
    gifwebp, anim_diff - default duration behavior (&lt;= 10ms)
    changed to match web browsers, transcoding
    tools (issue #379)
    img2webp, webpmux - allow options to be passed in via a file
    (issue #355)
- changes from 0.6.1
  - lossless performance and compression improvements + a new
    'cruncher' mode (-m 6 -q 100)
  - ARM performance improvements with clang (15-20% w/ndk r15c,
    issue #339)
  - webp-js: emscripten/webassembly based javascript decoder
  - miscellaneous bug &amp; build fixes (issue #329, #332, #343, #353,
    [#360], #361, #363)
  - Tool updates / additions:
  - added webpinfo - prints file format information (issue #330)
  - gif2webp - loop behavior modified to match Chrome M63+
    (crbug.com/649264); '-loop_compatibility' can be
    used for the old behavior
- changes from 0.6.0
  - lossless performance and compression improvements
  - miscellaneous performance improvements (SSE2, NEON, MSA)
  - webpmux gained a -duration option allowing for frame timing
    modification
  - new img2webp utility allowing a sequence of images to be
    converted to animated webp
  - API changes:
  - libwebp:
    WebPPictureSharpARGBToYUVA
    WebPPlaneDistortion
  - libwebpmux / gif2webp:
    WebPAnimEncoderOptions: kmax &lt;= 0 now disables keyframes,
    kmax == 1 forces all keyframes. See
    mux.h and the gif2webp manpage for
    details.
- changes from 0.5.2
  - This release covers CVE-2016-8888 and CVE-2016-9085.
  - further security related hardening in the tools; fixes to
    gif2webp/AnimEncoder (issues #310, #314, #316, #322),
    cwebp/libwebp (issue #312)
  - full libwebp (encoder &amp; decoder) iOS framework; libwebpdecoder
    WebP.framework renamed to WebPDecoder.framework (issue #307)
  - CMake support for Android Studio (2.2)
  - miscellaneous build related fixes (issue #306, #313)
  - miscellaneous documentation improvements (issue #225)
  - minor lossy encoder fixes and improvements
- changes from 0.5.1
  - miscellaneous bug fixes (issues #280, #289)
  - reverted alpha plane encoding with color cache for
    compatibility with libwebp 0.4.0-&gt;0.4.3 (issues #291, #298)
  - lossless encoding performance improvements
  - memory reduction in both lossless encoding and decoding
  - force mux output to be in the extended format (VP8X) when
    undefined chunks are present (issue #294)
  - gradle, cmake build support
  - workaround for compiler bug causing 64-bit decode failures on
    android devices using clang-3.8 in the r11c NDK
  - various WebPAnimEncoder improvements
- disable extras for now. it seems it is not building and
  installing a library anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1524916801">- update baselibs.conf for the new soversions</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562155200">- Update to version 1.0.2:
  * Lossless encoder speedups.
  * Lossy encoder speedup on ARM.
  * Lossless multi-threaded security fix.
- Changes from version 1.0.1:
  * Lossless encoder speedups.
  * Big-endian fix for alpha decoding.
  * Gif2webp fix for loop count=65535 transcode.
  * Further security related hardening in libwebp &amp; libwebpmux.
  * Miscellaneous bug &amp; build fixes.</changelog>
  <changelog author="jengelh@inai.de" date="1566648000">- Update to new upstream release 1.0.3
  * Resize fixes for Nx1 sizes and the addition of non-opaque
    alpha values for odd sizes.
  * Lossless encode/decode performance improvements.
  * Lossy compression performance improvement at low quality
    levels with flat content.
  * vwebp will now preserve the aspect ratio of images that
    exceed monitor resolution by scaling the image to fit.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1685448000">- Add libwebp-double-free.patch: Avoid a double free, upstream
  commit a486d800 (bsc#1210212 CVE-2023-1999).</changelog>
</package>
<package pkgid="0f8f9e359fd8982d96354829cdbcfbce7a261637fcfd4e6487f634d037e8916f" name="libwireshark15" arch="aarch64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="ca8043b316c2e30b41fb3ffd963c276549d153dcffa5313ec7d0973b17da3e9c" name="libwireshark15" arch="ppc64le">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="a6aa6802da8e2baf968be1f39156e7db8b6ade4ffbd261bcabc37e8a722bc81e" name="libwireshark15" arch="s390x">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="ffe195bb4cd84b99d8f6a726eb0b10cf5f6c82ecef52faeeb773a2fa3ece32ab" name="libwireshark15" arch="x86_64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="35a92cf3d5a04bf377938efb2193bcccfe3665260065366586de7da500795f2b" name="libwiretap12" arch="aarch64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="6a86f7df4b20f9abbc8dc2fa76892cdbc55e15bdfce95654d07b6d863575c971" name="libwiretap12" arch="ppc64le">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="c8c7e8cdc4e97eb6a0e3695fc41b3373d57f01008feb0f633ba379a19c545be4" name="libwiretap12" arch="s390x">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="13e06fe45cfdf7974612d0dd7ed374ce0a11959e8e89199ddadcf5e2ce143f69" name="libwiretap12" arch="x86_64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="947c6655ad867804fd64f185565fade2071a83a4da0bd0d357b8ed5248f62d56" name="libwsutil13" arch="aarch64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="0197cc71d53584de356e37f424a8b559869b059f8d48cfddacb154a215c98bce" name="libwsutil13" arch="ppc64le">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="9127b2dc51591806ec704ef8182f8a6ac9f65aa14bee90bf60ac06866032af0a" name="libwsutil13" arch="s390x">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="370d617e1911814b2bbadb3ac56e3187562ae018eecf1bbc5854d26c679f35ba" name="libwsutil13" arch="x86_64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="1340d52a1c47d2eb9a7a22e33b514c24ee8f82de02283b9c3b63375aadeb796d" name="libxmlsec1-1" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="2bd77d64c4ecc736560ae8daee7c822f9b779837f1440dd4aededcbb02675458" name="libxmlsec1-1" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="c8016de02b2b57ff1b22fcbe339978a804f6140b765fe46f7e74136fddc2f7fd" name="libxmlsec1-1" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="eea0a0b0f88c5f378f7e988923d2779dd48149b64db90ff3232cdcfb87547a86" name="libxmlsec1-1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="adc72f4c694aebe7b96f5b328c92ea224326cccc273a274d43dd61bc0a8f8158" name="libxmlsec1-gcrypt1" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="2f7d6dfcb1f0b6001c4453b682a3be846a7632da578bde5575a0e2e75c34ebe4" name="libxmlsec1-gcrypt1" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="5015371d885f8aab2118d8311e6cb72327f0378ce48333d6dcd38616171b6ebe" name="libxmlsec1-gcrypt1" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="342c5f5351a49d6c2a61ad06fefa44f04ab2c2ecd0c3c46944a3947d4876ba56" name="libxmlsec1-gcrypt1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="d047e5e5bacff1f5be4ed52aea0a8fcebbc16d6f213d45f1480d355b8329aba4" name="libxmlsec1-gnutls1" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="a05f12d2e50695baa8364b1e844ebc4bb493887bb6eea32d38d918ce3b690794" name="libxmlsec1-gnutls1" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="2bcc3da0ba06aa8000316c2394f6e93e83dcced9f6fc454a6fbe1623b933bfc4" name="libxmlsec1-gnutls1" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="b5bb75f41a74c98a03e71bfd4f413c854be3087b06358d9b8d61e4a063c076bb" name="libxmlsec1-gnutls1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="67c22e2f6214b1ff73b9820ba27be88a606f40081caa39637e5f1cbf840d61b4" name="libxmlsec1-nss1" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="77f6c35383040bfaf631e584178c2bd0417aa96314a3e2b400080e7cbccd74de" name="libxmlsec1-nss1" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="18f4e8837301cab5da7a1afc106355d5fd42a3de6ea406b311914a194a250511" name="libxmlsec1-nss1" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="177fb1790af28039c2a330c55be9c41e87b5568cd41754c188bc1c69f1caea50" name="libxmlsec1-nss1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="9e70633f1546ff04922d48346047bbb37afdf50de6df4542a2ae97a8fc28d25a" name="libxmlsec1-openssl1" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="e900f7189743e88e12e9de9fdbbfc12c052e768e1e867a7ddecab2e16bec8e48" name="libxmlsec1-openssl1" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="ba55ff78af52d6d9e620e3c8717dedb6321277d77e11c3a1e37267f4fb512eae" name="libxmlsec1-openssl1" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="adf92cde624ab64227484f0a11fa1c33fe3e575c527e07ed24ecbc001f8dfcb4" name="libxmlsec1-openssl1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="deeb52655c34786e5703051811baca16c473e3176223dcd4312032d4edf7d89f" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="fd1c4186d4fd3a0841bcec9486099b6689da50be7416fc33ccd7046a2eff70f1" name="libzypp" arch="ppc64le">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="e0c6f897bce261ea63171a66fd9cd507bdd1f99c854e639706d789f62bf24040" name="libzypp" arch="s390x">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="e266c198877a2ce39c29d12fc849b8ec88d846306eebbc305562ab937d59f750" name="libzypp" arch="src">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="3d1da0ce2f4978795a0a9ca168e6379dc610931f3efa8d78258a2129169b7326" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="90e4c2b315247bb439083ea0cc07f99d536cefd751c3e041f14cef6735a73247" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="a2ab97d35b91702af969f6dbce7e0118a3e128645423eeec66153ca71bcef25e" name="libzypp" arch="ppc64le">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="18afe7e4a0eba26b5bc446fbb40053c4011a5d3796f7e61e99e93c8f6f8a4493" name="libzypp" arch="s390x">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="021597161e769b08d075de06eaef87f6a1e1ae5c18f232d8984cf40f2db05949" name="libzypp" arch="src">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="2d74f4e1a00f6689a61ddda4ddf09b40b344e62595357018d21d0b86f727c23e" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="89436fd163713f384f9729cade69f47f813e5e11c6f5e170f0681260b2e8087b" name="libzypp-devel" arch="aarch64">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="7e4e6d2ad4094750d2fda29196640f975f717d2307571a0b002339242973d7d6" name="libzypp-devel" arch="ppc64le">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="b933f09f92d2a637633ab68ed5d03f7455a5f3f49f580984d4266fb9c9f69d92" name="libzypp-devel" arch="s390x">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="b15bc180c6c1262fa48d995393291dbe1c0907cc3ba42678e164bade72b59a8d" name="libzypp-devel" arch="x86_64">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="dc79ea2d8366e3e0863704e6edcd4933989ba20eaf68a38dad5fdb7b4c0a568f" name="libzypp-devel" arch="aarch64">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="2f22c8d8353def6eae73b7ac452b7d80e8570937ae337f07fd93da11f1a1174b" name="libzypp-devel" arch="ppc64le">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="f4897c707d5e73253e18dfe4d21447e3e02c0d3d68e55db51810fe2e1d5b762a" name="libzypp-devel" arch="s390x">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="71c8ef279241787244e4b017996676b9fa734b7e719efa054e98be490a6f264d" name="libzypp-devel" arch="x86_64">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="22e3aa71d88183b1beff690063ea70b466dd2bf54f84553a487d1c06519dc331" name="libzypp-devel-doc" arch="aarch64">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="231f502f9c7037b95b9c6eb3508fa4286e347179b350f5b97423f057f5a6599d" name="libzypp-devel-doc" arch="ppc64le">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="50889607f526a1de9cb9134644671596f7a6fb591f186c2c5fa99ab37a8f2d5f" name="libzypp-devel-doc" arch="s390x">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="344bddd7ae40d2ab02de9b92f52511a751a3a95064a3e1c1dd5f64de5f5015da" name="libzypp-devel-doc" arch="x86_64">
  <version epoch="0" ver="17.31.11" rel="150400.3.25.2"/>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
</package>
<package pkgid="c23395e1192f546046d8a77343c5f0f9b9100372bec36b6a7364c5307291e8ff" name="libzypp-devel-doc" arch="aarch64">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="27d3347bfb66102081a936e256e58163bd90e881e07a78252f8b12843e885ec0" name="libzypp-devel-doc" arch="ppc64le">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="c7257c40ac3127629c564a0026d3433a6dae8f4b38f557d2bbd2e05d7385ebd6" name="libzypp-devel-doc" arch="s390x">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="7c2902f63235309e94fd20b0387db73872b90de1ea0825a7d66c324662b65964" name="libzypp-devel-doc" arch="x86_64">
  <version epoch="0" ver="17.31.13" rel="150400.3.30.1"/>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Workround bsc#1195633 while libsolv &lt;= 0.7.23 is used.
- Fix potential endless loop in new ZYPP_MEDIANETWORK.
- ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors
  parsed from a metalink file.
- multicurl: propagate ssl settings stored in repo url
  (boo#1127591)
  Closes #335.
- Teach MediaNetwork to retry on HTTP2 errors.
- fix CapDetail to return Rel::NONE if an EXPRESSION is used as a
  NAMED cap.
- Capability: support parsing richdeps from string.
- defaultLoadSystem: default to LS_NOREFRESH if not root.
- Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes
  [#439])
  Merges rpm-software-management/rpm#2412: The bit for LZCNT is in
  CPUID 0x80000001, not 1.
- Detect x86_64_v[234] architecture levels (fixes #439)
- Support x86_64_v[234] architecture levels (for #439)
- version 17.31.9 (22)</changelog>
  <changelog author="ma@suse.de" date="1681387200">- BuildRequires: libsolv-devel &gt;= 0.7.24 for x86_64_v[234]
  support.
- version 17.31.10 (22)</changelog>
  <changelog author="aschnell@suse.com" date="1682337600">- fix build with boost 1.82</changelog>
  <changelog author="ma@suse.de" date="1682683200">- MediaCurl: Fix endless loop if wrong credentials are stored in
  credentials.cat (bsc#1210870)
  Since libzypp-17.31.7 wrong credentials stored in credentials.cat
  may lead to an endless loop. Rather than asking for the right
  credentials, the stored ones are used again and again.
- zypp.conf: Introduce 'download.connect_timeout' [60 sec.]
  (bsc#1208329)
  Maximum time in seconds that you allow the connection phase to
  the server to take. This only limits the connection phase, it has
  no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT)
- commit: Try to provide /dev fs if not present (fixes #444)
- fix build with boost 1.82.
- version 17.31.11 (22)</changelog>
  <changelog author="ma@suse.de" date="1685966400">- Do not unconditionally release a medium if provideFile failed
  (bsc#1211661)
- libzypp.spec.cmake: remove duplicate file listing.
- version 17.31.12 (22)</changelog>
  <changelog author="ma@suse.de" date="1686571200">- curl: Trim user agent string (bsc#1212187)
  HTTP/2 RFC 9113 forbids fields ending with a space. Violation
  results in curl error: 92: HTTP/2 PROTOCOL_ERROR.
- version 17.31.13 (22)</changelog>
</package>
<package pkgid="3af793c8f9647701c9e1bacbb1684eaaace6a0558135f7d4891ae3151945f620" name="mariadb" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="1ed5356c485516e3ff7c0bdd597e77fca08ffe5e8173a51502ceb436567d945f" name="mariadb" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="952f1d67a538060d039ff4dc53f4c24af4ae91e8b48d371ad3e6fd8931a0b6a0" name="mariadb" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="4bae0ed92cdec3eb9cb7c069a1e92e39db7b51417309a218392d2567f29e86da" name="mariadb" arch="src">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="5243e2b58d620c0df6f3af171d718a9fa3bb817b6530b6c411842b9fbf383b99" name="mariadb" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="68dfe0fa4ef7998da665ba9dbb3d0076aab211fa79f36d923b1458ae82cf26a3" name="mariadb-bench" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="3481bdb1ba36d418b23ededd186268950a27be4c75f1b9d88cd6ab7e45a37c2f" name="mariadb-bench" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="a393c9092e8a9fccf385f37f2cadcba21237fd86ff65e552a729764a724d5053" name="mariadb-bench" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="d94e57d6e6a30f144262ec48953cbc29bab08d03cdfe00caee9c443ddafb0020" name="mariadb-bench" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="0bc2b370080ee90e0c987a39aecbe91d35e2e8e2c1007ca7e875cdd6141797bd" name="mariadb-client" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="2507e45f13e98da6ebfe407ac2088626efb6318e80aad083e856a147a3433c3d" name="mariadb-client" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="49921c5b988c10ce49b9d887a2ce4dd7421f6ccae56fb18e76e5a3fd2a910c81" name="mariadb-client" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="3d0c974373ba29680310c0e97840deac26879f858e7d7ed90db35061305db4b2" name="mariadb-client" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="fabaa1a7f2788308bc9e65e918e2dee075b65fc7186200098bc335eac250a493" name="mariadb-errormessages" arch="noarch">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="96ad51c1980029a3d159eb61792f605292a5a623188b4dfb751c3291fa37bb3e" name="mariadb-galera" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="f5a3d799e06cecdc49b537a2d096910ae705c37b0e729724bc4ebd491d2812b4" name="mariadb-galera" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="5be70450397268698d9a89a13d05fd4493bac3e5dc14a4054cf476f30afef14d" name="mariadb-galera" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="2c5b09834e1c80ef2eb445b549f45713179e1b454bfd6e7370a1d136d04bf650" name="mariadb-galera" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="3b7406bb38d8a1b90c92eb6634143e46ac84658844c462d7337cc84956cb38ca" name="mariadb-rpm-macros" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="664b86326113db8d9e308c265fdd1e0525f554d91eb3da49e1bc44950a1b0180" name="mariadb-rpm-macros" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="907d15cbecbebf2b8406237079931f3a2a63ccc764f71d9c26d51ec5915a3fbd" name="mariadb-rpm-macros" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="7ae0250112cb0dea532885ffed2fe05a593a6483f4ebdc33e3174480bc574cfc" name="mariadb-rpm-macros" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="7c2d491b25ad0ebda5202671aa90b9250975ebd0a674c668ad9a81dd55112ce0" name="mariadb-test" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="9cfd993d24cf8a439543ead9011f16444414291576f0f5c51247a59a0974d96d" name="mariadb-test" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="21f21423f41e76d8ebe3345a8405a53ff80557b25abae5d243144a4dc92beef4" name="mariadb-test" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="e644c7b2b6221c38a30c9a0fb3fb3e0fba26212aeddb0175b068da10ba7aa68a" name="mariadb-test" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="6105f011e5e7503dae14255ac1d5023712934a6ad9d7873af46bda54f6e577ed" name="mariadb-tools" arch="aarch64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="269e5c79adc206a7dfcf0af5fe394f1bbd12d74e358e39d92d081c933c70be60" name="mariadb-tools" arch="ppc64le">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="e29912271d78763c6cb35c374cf93c580d36a219b6e05828890224efe43b9ca0" name="mariadb-tools" arch="s390x">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="9dd8c072bb32460b15acb24ec8a66aa038f99e42471edd9b30522f9116f0149a" name="mariadb-tools" arch="x86_64">
  <version epoch="0" ver="10.6.13" rel="150400.3.23.1"/>
  <changelog author="mliska@suse.cz" date="1629460800">- Support both rpmlint 1.x and 2.x.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1630929600">- Update to 10.6.4
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1064-release-notes
    https://mariadb.com/kb/en/library/mariadb-1064-changelog
    https://mariadb.com/kb/en/library/mariadb-1063-release-notes
    https://mariadb.com/kb/en/library/mariadb-1063-changelog
    https://mariadb.com/kb/en/library/mariadb-1062-release-notes
    https://mariadb.com/kb/en/library/mariadb-1062-changelog
    https://mariadb.com/kb/en/library/mariadb-1061-release-notes
    https://mariadb.com/kb/en/library/mariadb-1061-changelog
    https://mariadb.com/kb/en/library/mariadb-1060-release-notes
    https://mariadb.com/kb/en/library/mariadb-1060-changelog
  * fixes for the following security vulnerabilities:
    10.6.4: CVE-2021-2372
    CVE-2021-2389
- Removed support to tokudb as it has been removed from upstream
- Refresh mariadb-10.2.4-fortify-and-O.patch
- Add new systemd socket from upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1632139200">- Replace %{_rpmconfigdir}/macros.d with %{_rpmmacrodir},
  remove ownership of this directory. Fixes boo#1182218
- Run spec-cleaner</changelog>
  <changelog author="jsegitz@suse.com" date="1633521600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_mariadb.service.patch
  Modified:
  * mariadb.service.in</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633608000">- Fix socket address in mariadb@.socket file</changelog>
  <changelog author="suse-beta@cboltz.de" date="1635681600">- Add func_math_tests_MDEV-26645.diff to avoid test failures in the func_math
  test on Tumbleweed s390x and ppc64 until MDEV-26645 gets fixed upstream</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636372800">- Use pam macros instead of hardcoding directories, fixes bsc#1191038
- Add fix-pamdir.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636459200">- Update to 10.6.5
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1065-release-notes
    https://mariadb.com/kb/en/library/mariadb-1065-changelog
  * fixes for the following security vulnerabilities:
    10.6.5: none
- Not affected by [CVE-2021-35604], bsc#1192497
- Drop upstreamed patch:
  * mariadb-10.2.19-link-and-enable-c++11-atomics.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636718400">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977600">- Revert systemd hardening
  * Remove harden_mariadb.service.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1636977601">- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637064000">- Fix rpmlint errors
- Run spec-cleaner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637582400">- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  bsc#1189320
  CVE-2021-2154, bsc#1185872
  CVE-2021-2166, bsc#1185870
  CVE-2021-27928, bsc#1183770
  MDEV-23851</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645012800">- Update to 10.6.7 (bsc#1196016):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1067-release-notes
    https://mariadb.com/kb/en/library/mariadb-1067-changelog
    https://mariadb.com/kb/en/library/mariadb-1066-release-notes
    https://mariadb.com/kb/en/library/mariadb-1066-changelog
  * fixes for the following security vulnerabilities:
    10.6.7: CVE-2021-46665
    CVE-2021-46664
    CVE-2021-46661
    CVE-2021-46668
    CVE-2021-46663
    10.6.6: CVE-2022-24052
    CVE-2022-24051
    CVE-2022-24050
    CVE-2022-24048
    CVE-2021-46659, bsc#1195339
- Skip failing tests for s390x, fixes bsc#1195076
  * suse_skipped_tests.list
- Remove upstreamed patches:
  * mariadb-10.0.15-logrotate-su.patch
  * mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- The following issues have already been fixed in this package but weren't
  previously mentioned in the changes file:
  CVE-2021-46658, bsc#1195334
  CVE-2021-46657, bsc#1195325</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646740800">- Build mariadb-galera on SLE (jsc#SLE-22245)
- Add dependency on galera-4 for mariadb-galera
- Remove old constraints for mariadb-galera</changelog>
  <changelog author="danilo.spinella@suse.com" date="1653566400">- Update to 10.6.8 (bsc#1199928):
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1068-release-notes
    https://mariadb.com/kb/en/library/mariadb-1068-changelog
  * fixes for the following security vulnerabilities:
    10.6.8:  CVE-2021-46669
    CVE-2022-27376 (bsc#1198628)
    CVE-2022-27377 (bsc#1198603)
    CVE-2022-27378 (bsc#1198604)
    CVE-2022-27379 (bsc#1198605)
    CVE-2022-27380 (bsc#1198606)
    CVE-2022-27381 (bsc#1198607)
    CVE-2022-27382 (bsc#1198609)
    CVE-2022-27383 (bsc#1198610)
    CVE-2022-27384 (bsc#1198611)
    CVE-2022-27386 (bsc#1198612)
    CVE-2022-27387 (bsc#1198613)
    CVE-2022-27444 (bsc#1198634)
    CVE-2022-27445 (bsc#1198629)
    CVE-2022-27446 (bsc#1198630)
    CVE-2022-27447 (bsc#1198631)
    CVE-2022-27448 (bsc#1198632)
    CVE-2022-27449 (bsc#1198633)
    CVE-2022-27451 (bsc#1198639)
    CVE-2022-27452 (bsc#1198640)
    CVE-2022-27455 (bsc#1198638)
    CVE-2022-27456 (bsc#1198635)
    CVE-2022-27457 (bsc#1198636)
    CVE-2022-27458 (bsc#1198637)
    CVE-2022-32088 (bsc#1201168)
    CVE-2022-32087 (bsc#1201167)
    CVE-2022-32086 (bsc#1201166)
    CVE-2022-32085 (bsc#1201165)
    CVE-2022-32083 (bsc#1201163)
- Update list of skipped tests
- The following issue is not affecting this package:
  * CVE-2022-21427</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661774400">- Update to 10.6.9:
  * release notes and changelog:
    https://mariadb.com/kb/en/library/mariadb-1069-release-notes
    https://mariadb.com/kb/en/library/mariadb-1069-changelog
  * fixes for the following security vulnerabilities:
    10.6.9: CVE-2022-32082 (bsc#1201162)
    CVE-2022-32089 (bsc#1201169)
    CVE-2022-32081 (bsc#1201161)
    CVE-2022-32091 (bsc#1201170)
    CVE-2022-32084 (bsc#1201164)
    CVE-2022-38791 (bsc#1202863)
  * The package is not affected by the following security vulnerabilities:
    CVE-2018-25032 (bsc#1197459)
- Update mysql-systemd-helper to be aware of custom group, bsc#1200105
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1663761600">- Update to 10.6.10:
    https://mariadb.com/kb/en/library/mariadb-10610-release-notes
    https://mariadb.com/kb/en/library/mariadb-10610-changelog
  * fixes for the following security vulnerabilities:
    10.6.10: none</changelog>
  <changelog author="danilo.spinella@suse.com" date="1677585600">- Update to 10.6.12:
    https://mariadb.com/kb/en/library/mariadb-10612-release-notes
    https://mariadb.com/kb/en/library/mariadb-10612-changelog
    https://mariadb.com/kb/en/library/mariadb-10611-release-notes
    https://mariadb.com/kb/en/library/mariadb-10611-changelog
  * fixes for the following security vulnerabilities:
    10.6.12: none
    10.6.11: none
- Update mariadb.keyring
- Update list of skipped tests</changelog>
  <changelog author="danilo.spinella@suse.com" date="1684843200">- Update to 10.6.13:
    https://mariadb.com/kb/en/mariadb-10-6-13-release-notes/
    https://mariadb.com/kb/en/mariadb-10-6-13-changelog/
  * fixes for the following security vulnerabilities:
    10.6.13: CVE-2022-47015 (bsc#1207404)
- Update list of skipped tests</changelog>
</package>
<package pkgid="62061ab7e2ed4289907db3a9ffeefe7da8c2f25fa8bbcb67da20c0b2d108c84f" name="mockito" arch="noarch">
  <version epoch="0" ver="1.10.19" rel="150200.3.4.1"/>
  <changelog author="fstrba@suse.com" date="1549972800">- Initial packaging of mockito 1.10.19</changelog>
  <changelog author="jengelh@inai.de" date="1553342400">- Remove nonsense and bias from description.</changelog>
  <changelog author="fstrba@suse.com" date="1575028800">- Modified patch:
  * fix-bnd-config.patch
    + allow using objenesis 3.x too</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Fetch sources using source service instead of script</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1654776000">- Removed patch:
  * mockito-hamcrest.patch
    + Do not import org.hamcrest.core bundle that does not exist in
    hamcrest 2.x</changelog>
</package>
<package pkgid="4d0a480b8608ebdbfeee39cb3f7edbe67fde56278d9044b472a23596148ff5c6" name="mockito" arch="src">
  <version epoch="0" ver="1.10.19" rel="150200.3.4.1"/>
  <changelog author="fstrba@suse.com" date="1549972800">- Initial packaging of mockito 1.10.19</changelog>
  <changelog author="jengelh@inai.de" date="1553342400">- Remove nonsense and bias from description.</changelog>
  <changelog author="fstrba@suse.com" date="1575028800">- Modified patch:
  * fix-bnd-config.patch
    + allow using objenesis 3.x too</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Fetch sources using source service instead of script</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1654776000">- Removed patch:
  * mockito-hamcrest.patch
    + Do not import org.hamcrest.core bundle that does not exist in
    hamcrest 2.x</changelog>
</package>
<package pkgid="b11b4312ca54d3328cb15412d37cff88c36e05f3198fbf1a383caedf1fde2ba5" name="mockito-javadoc" arch="noarch">
  <version epoch="0" ver="1.10.19" rel="150200.3.4.1"/>
  <changelog author="fstrba@suse.com" date="1549972800">- Initial packaging of mockito 1.10.19</changelog>
  <changelog author="jengelh@inai.de" date="1553342400">- Remove nonsense and bias from description.</changelog>
  <changelog author="fstrba@suse.com" date="1575028800">- Modified patch:
  * fix-bnd-config.patch
    + allow using objenesis 3.x too</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Fetch sources using source service instead of script</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1654776000">- Removed patch:
  * mockito-hamcrest.patch
    + Do not import org.hamcrest.core bundle that does not exist in
    hamcrest 2.x</changelog>
</package>
<package pkgid="40c07493e7a987eb42b0b88220b7fb958562159d9d612b8c4ffe71938745d999" name="mojo-executor" arch="noarch">
  <version epoch="0" ver="2.4.0" rel="150200.3.3.12"/>
  <changelog author="fstrba@suse.com" date="1572696000">- Initial packaging of mojo-executor 2.3.0</changelog>
  <changelog author="fstrba@suse.com" date="1574596800">- Upgrade to version 2.3.1
- Added patch:
  * mojo-executor-dependency.patch
    + Collections.emptyList() has type of  java.lang.Object and
    cannot be cast to List&lt;Dependency&gt;.
- Specify maven.compiler.release to fix build with jdk9+ and newer
  maven-javadoc-plugin</changelog>
  <changelog author="dmueller@suse.com" date="1670155200">- update to 2.4.0:
  * Dependencies provided by Maven have been moved to the provided scope where
    possible
  * The plexus-utils dependency must remain in the compile scope due to
    MNG-6965. It has been updated to version 3.0.24 to avoid spurious security
    vulnerability notifications due to this dependency.</changelog>
</package>
<package pkgid="7c123218a3d7052ba293797be8955f4bd6ac1dcdc2ebf86e2a906a2495ab800d" name="mojo-executor" arch="src">
  <version epoch="0" ver="2.4.0" rel="150200.3.3.12"/>
  <changelog author="fstrba@suse.com" date="1572696000">- Initial packaging of mojo-executor 2.3.0</changelog>
  <changelog author="fstrba@suse.com" date="1574596800">- Upgrade to version 2.3.1
- Added patch:
  * mojo-executor-dependency.patch
    + Collections.emptyList() has type of  java.lang.Object and
    cannot be cast to List&lt;Dependency&gt;.
- Specify maven.compiler.release to fix build with jdk9+ and newer
  maven-javadoc-plugin</changelog>
  <changelog author="dmueller@suse.com" date="1670155200">- update to 2.4.0:
  * Dependencies provided by Maven have been moved to the provided scope where
    possible
  * The plexus-utils dependency must remain in the compile scope due to
    MNG-6965. It has been updated to version 3.0.24 to avoid spurious security
    vulnerability notifications due to this dependency.</changelog>
</package>
<package pkgid="4c5960874f2dcf448926b2aafc2e55c95d82c91c236a01465ca11260d865b36d" name="mojo-executor-javadoc" arch="noarch">
  <version epoch="0" ver="2.4.0" rel="150200.3.3.12"/>
  <changelog author="fstrba@suse.com" date="1572696000">- Initial packaging of mojo-executor 2.3.0</changelog>
  <changelog author="fstrba@suse.com" date="1574596800">- Upgrade to version 2.3.1
- Added patch:
  * mojo-executor-dependency.patch
    + Collections.emptyList() has type of  java.lang.Object and
    cannot be cast to List&lt;Dependency&gt;.
- Specify maven.compiler.release to fix build with jdk9+ and newer
  maven-javadoc-plugin</changelog>
  <changelog author="dmueller@suse.com" date="1670155200">- update to 2.4.0:
  * Dependencies provided by Maven have been moved to the provided scope where
    possible
  * The plexus-utils dependency must remain in the compile scope due to
    MNG-6965. It has been updated to version 3.0.24 to avoid spurious security
    vulnerability notifications due to this dependency.</changelog>
</package>
<package pkgid="93fc77b308c5bbff2c5c135f3aa2d909c98e59b14e6c20c8cbe4309df8eb3fd6" name="mojo-parent" arch="noarch">
  <version epoch="0" ver="70" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1552824000">- Initial packaging of mojo-parent 40</changelog>
  <changelog author="fstrba@suse.com" date="1648209600">- Upgrade to version 60
  * Compatible with newer plugins</changelog>
  <changelog author="dmueller@suse.com" date="1670155200">- update to 70:
  * Improvement checkstyle configuration
  * Add modello-maven-plugin to pluginManagement
  * Remove Google search box due to privacy (#274) @slawekjaranowski
  * Put version for mrm-maven-plugin in property (#273) @slawekjaranowski
  * Add streamLogsOnFailures to m-invoker-p (#272) @slawekjaranowski
  * Add property for maven-fluido-skin version (#268) @slawekjaranowski
  * Setup Apache Matomo analytics (#259) @slawekjaranowski
  * Downgrade Checkstyle to 9.3. 10.x requires Java 11(ecfb1d1)
  * remove requirement to use ssh for github scm devCon
  * Require Maven 3.2.5 (#215) @slachiewicz
  * [#225] add SHA-512 hashes (#226) @bmarwell
  * Extract plugin version as variable so child pom can override if needed (#84) @nhojpatrick
  * remove issue-tracking as do not exists anymore (#148) @olamy
  * remove cim report as it do not exists anymore (#147) @olamy</changelog>
</package>
<package pkgid="095907ed63dcd9d802fc5d554218bb0d8deb5427cad4e89dc4e22e0caaeb2a6e" name="mojo-parent" arch="src">
  <version epoch="0" ver="70" rel="150200.3.7.1"/>
  <changelog author="fstrba@suse.com" date="1552824000">- Initial packaging of mojo-parent 40</changelog>
  <changelog author="fstrba@suse.com" date="1648209600">- Upgrade to version 60
  * Compatible with newer plugins</changelog>
  <changelog author="dmueller@suse.com" date="1670155200">- update to 70:
  * Improvement checkstyle configuration
  * Add modello-maven-plugin to pluginManagement
  * Remove Google search box due to privacy (#274) @slawekjaranowski
  * Put version for mrm-maven-plugin in property (#273) @slawekjaranowski
  * Add streamLogsOnFailures to m-invoker-p (#272) @slawekjaranowski
  * Add property for maven-fluido-skin version (#268) @slawekjaranowski
  * Setup Apache Matomo analytics (#259) @slawekjaranowski
  * Downgrade Checkstyle to 9.3. 10.x requires Java 11(ecfb1d1)
  * remove requirement to use ssh for github scm devCon
  * Require Maven 3.2.5 (#215) @slachiewicz
  * [#225] add SHA-512 hashes (#226) @bmarwell
  * Extract plugin version as variable so child pom can override if needed (#84) @nhojpatrick
  * remove issue-tracking as do not exists anymore (#148) @olamy
  * remove cim report as it do not exists anymore (#147) @olamy</changelog>
</package>
<package pkgid="c7d0a1d40bcb1418538c519b6343f9d046526acbd82a78a4e3f4e09be4fd6041" name="net-snmp" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="d3d9c48866c690213a3cef94dfc099df88fe1f28e712cd515bda31a45e507a35" name="net-snmp" arch="ppc64le">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="c4e1e2a35912033f83d8fcf30397e619c5896f239c3df3c28a23c1e76b936fe1" name="net-snmp" arch="s390x">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="49e53ddf566f5210fb46906117fad92db97b38423285dce6969d688470bbb6f5" name="net-snmp" arch="src">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="f16d42d8de81312eab97362e12b7e5ee611dd4417ae053273a4a84f880130f30" name="net-snmp" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="55dda6b1aaca274058eced4e35e7dd4f7e5d05f376d8b7f0df36ab970f51297b" name="net-snmp-devel-32bit" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="8be69f1ae8a2810be6d9e69f0b4482ca0866e9e7e55cf0fef0218999f2bb7566" name="net-snmp-devel" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="79abb4e7e1823ed4ea86cf571862c50d905a8f8d027b489e980fdcde7a779c01" name="net-snmp-devel" arch="ppc64le">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="c2013a3bda62f0e296cccd5cb1781589cec7fd6e6d4a51f0b3eef512513670c5" name="net-snmp-devel" arch="s390x">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="c56caaf9bc673558bd78ab5c4c795951fa961fc10792e5e4d6181c89393fa785" name="net-snmp-devel" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="be609c70fb74fe84941d7091f7f39e21683d6b395821f99d889f8f4a874ff806" name="nodejs18" arch="aarch64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="f1350faea2f262c04e00af57341f4c54153e7f75f3523e17d394dbf619b699eb" name="nodejs18" arch="s390x">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="b35129a666d4151ceeb4a322027c6b9e0b8b1df26cfb12044ee2fb3a710817f8" name="nodejs18" arch="src">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="b48aca9542e55bc3bd3f7dd60bc67ab0c208b6004e564e4a22472be16f17a3f3" name="nodejs18" arch="x86_64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="faaf8390ab860fe8de7b1a4efe65bd2af5fe5ef95043ae4aba8816ebf1f964c9" name="nodejs18-devel" arch="aarch64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="0ecab1677cd0f2ad74e340a46dfec70b3c19cb1fa25e61500d3da4c17c2fdc29" name="nodejs18-devel" arch="s390x">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="a5bb8c699f70f033efd638a779a820da5ba0bdf83dfcb418194e487ff6dd2563" name="nodejs18-devel" arch="x86_64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="e8e0d44dd5f86689f25dbef3d2b709e70c9b0b6301a53d3f8916809b8d731bb2" name="nodejs18-docs" arch="noarch">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="de2f8af56b2868d3f8034ebaf76426a4ece651b5bc2a5f3650d42db979d98a39" name="npm18" arch="aarch64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="dd9743241c7e7fd2c57a106d0dfd37566baf4ceac7335830a41ac292e354e378" name="npm18" arch="s390x">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="7c33fb41cc8100a5751275958a8704a657352487ade185d40eaef18702754b01" name="npm18" arch="x86_64">
  <version epoch="0" ver="18.13.0" rel="150400.9.3.1"/>
  <changelog author="adam.majer@suse.de" date="1656417600">- Update to Nodejs 18.4.0. For detailed changes see,
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0
- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1657540800">- Update to Nodejs 18.5.0:
  * http: stricter Transfer-Encoding and header separator parsing
    (bsc#1201325, bsc#1201326, bsc#1201327,
    CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  * src: fix IPv4 validation in inspector_socket
    (bsc#1201328, CVE-2022-32212)
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0</changelog>
  <changelog author="adam.majer@suse.de" date="1658664000">- Update to Nodejs 18.6.0:
  * Experimental ESM Loader Hooks API. For details see,
    https://nodejs.org/api/esm.html
  * dns: export error code constants from dns/promises
  * esm: add chaining to loaders
  * http: add diagnostics channel for http client
  * http: add perf_hooks detail for http request and client
  * module: add isBuiltIn method
  * net: add drop event for net server
  * test_runner: expose describe and it
  * v8: add v8.startupSnapshot utils
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0</changelog>
  <changelog author="adam.majer@suse.de" date="1659268800">- dns.patch: fix regression
  https://github.com/nodejs/node/issues/44003</changelog>
  <changelog author="adam.majer@suse.de" date="1660824000">- Update to Nodejs 18.7.0:
  * events: add CustomEvent
  * http: add drop request event for http server
  * lib: improved diagnostics_channel subscribe/unsubscribe
  * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)</changelog>
  <changelog author="adam.majer@suse.de" date="1663243200">- Update to Nodejs 18.9.0:
  * lib - add diagnostics channel for process and worker
  * os - add machine method
  * report - expose report public native apis
  * src - expose environment RequestInterrupt api
  * vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
  * bootstrap: implement run-time user-land snapshots via
  - -build-snapshot and --snapshot-blob. See
  * crypto:
    + allow zero-length IKM in HKDF and in webcrypto PBKDF2
    + allow zero-length secret KeyObject
  * deps: upgrade npm to 8.18.0
  * http: make idle http parser count configurable
  * net: add local family
  * src: print source map error source on demand
  * tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
- new_python3.patch: enable python 3.11 as valid interpreter</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1663416000">- Skip test-fs-utimes-y2K38.js on armv6hl as well as armv7hl.</changelog>
  <changelog author="adam.majer@suse.de" date="1664193600">- Update to Nodejs 18.9.1:
  * deps: llhttp updated to 6.0.10
    + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
    + Incorrect Parsing of Multi-line Transfer-Encoding
    (CVE-2022-32215, bsc#1201327)
    + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
  * crypto: fix weak randomness in WebCrypto keygen
    (CVE-2022-35255, bsc#1203831)</changelog>
  <changelog author="adam.majer@suse.de" date="1664452800">- Update to NodeJS 18.10.0:
  * deps: upgrade npm to 8.19.2
  * http: throw error on content-length mismatch
  * stream: add ReadableByteStream.tee()
- openssl3_fixups.patch: upstreamed and removed</changelog>
  <changelog author="dmueller@suse.com" date="1665144000">- skip more tests for riscv64/qemu emulation</changelog>
  <changelog author="adam.majer@suse.de" date="1665576000">- qemu_timeouts_arches.patch: set timeouts on riscv5 to 7x normal</changelog>
  <changelog author="adam.majer@suse.de" date="1666008000">- Update to NodeJS 18.11.0:
  * added experimental watch mode -- running in 'watch' mode using
    node --watch restarts the process when an imported file is changed
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * lib: refactor transferable AbortSignal
  * src: add detailed embedder process initialization API
  * util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1666958400">- Update to NodeJS 18.12.0 LTS:
  * Running in 'watch' mode using node --watch restarts the process
    when an imported file is changed.
  * fs: add FileHandle.prototype.readLines
  * http: add writeEarlyHints function to ServerResponse
  * http2: make early hints generic
  * util: add default value option to parsearg</changelog>
  <changelog author="adam.majer@suse.de" date="1667822400">- Update to NodeJS 18.12.1 LTS:
  * inspector: DNS rebinding in --inspect via invalid octal IP
    (bsc#1205119, CVE-2022-43548)</changelog>
  <changelog author="adam.majer@suse.de" date="1667822401">- Fix migration to openssl-3 (bsc#1205042)</changelog>
  <changelog author="adam.majer@suse.de" date="1668081600">- icu721_fixes.patch: fixes compatibility with ICU 72.1 (bsc#1205236)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1671796800">- Update _constraints:
  * Less RAM for aarch64 and 32-bit arm
  * Use 'asimdrdm' cpu flag to use aarch64 workers where tests
    are more stable</changelog>
  <changelog author="adam.majer@suse.de" date="1673870400">- Update to NodejJS 18.13.0 LTS:
  * build: disable v8 snapshot compression by default
  * crypto: update root certificates
  * deps: update ICU to 72.1
  * doc:
    + add doc-only deprecation for headers/trailers setters
    + add Rafael to the tsc
    + deprecate use of invalid ports in url.parse
    + deprecate url.parse()
  * lib: drop fetch experimental warning
  * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
  * src:
    + add uvwasi version
    + add initial shadow realm support
  * test_runner:
    + add t.after() hook
    + don't use a symbol for runHook()
  * tls:
    + add "ca" property to certificate object
  * util:
    + add fast path for utf8 encoding
    + improve textdecoder decode performance
    + add MIME utilities
- new_python3.patch, icu721_fixes.patch: upstreamed, removed</changelog>
  <changelog author="adam.majer@suse.de" date="1674648000">- Again use openssl-3, if available.
- _constraints: reset aarch64 memory requirements back to original
  otherwise some unit tests can fail
- s390.patch: fix unit test on s390 with patched zlib</changelog>
  <changelog author="dimstar@opensuse.org" date="1675252800">- Do not use pkg_vcmp to decide BuildDependencies: this works based
  on 'installed packages' which is not interpreted correctly by the
  scheduler. Rather switch to boolean dependencies.</changelog>
</package>
<package pkgid="c3b7a3f34dbaa0849764648e1a1071d544a958b55c4b58c0a39ca470f41411ff" name="nvme-cli" arch="aarch64">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="08257592d8f65f1f75d45cf7e4bb8f7abb75003fef4569b69d2adc5f34615447" name="nvme-cli" arch="ppc64le">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="fc57cdb6faedb3a42d765520145ae1d78ed28c3846e382dd5c7a53780c8d1799" name="nvme-cli" arch="s390x">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="ef10e019bcc7f141985ef754871b00e26dd4a5811140fd26e950f6594936d365" name="nvme-cli" arch="src">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="ebeba83d2e15a1c521e0354160674f32534e89e2975231e7bb9acf97757dd50a" name="nvme-cli" arch="x86_64">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="4717ab39818f938a7b681ffe5dcc648b246364d67a0cf7576a580fc4828be535" name="nvme-cli-bash-completion" arch="noarch">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="aea6e530f45e17691bd90b09670031a6196de8e0771a155a09311c89d61d8a63" name="nvme-cli-regress-script" arch="noarch">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="eca582fe18c3b1b35330702bc6cc0b0f53c39b9418777b39d30bec81c3a7ec90" name="nvme-cli-zsh-completion" arch="noarch">
  <version epoch="0" ver="2.4+17.gf4cfca93998a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
</package>
<package pkgid="0d62aa1e121fb4e499e8ea5e8d12cfe7734b70851b9ee294b6d5a7957cbe531a" name="nvme-stas" arch="aarch64">
  <version epoch="0" ver="2.2" rel="150500.3.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1643284800">- Initial nvme-stas packaging</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645012800">- Update to version 1.0-rc1:
  * fix comment
  * Perform explicit registration from user-space
  * Add known image to docker-compose
  * Add docker run/build way to README
  * Actions: Disable actions/setup-python
  * Actions: Work on incoming branch
  * Fixing docker compilation error
  * Update docker-publish.yml
  * Fix github workflow
  * removed unused code
  * D-Bus config fixes.
  * github workflow actions - fix PYTHONPATH</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645617600">- Update to version 1.0-rc2:
  * Fis github workflows to pull from upstream libnvme
  * TP8010 was merged into upstream libnvme. Some APIs have changed.
    This is to update nvme-stas to the new APIs.
  * A bunch of mostly cosmetic changes
  * Cleaning up a few things.
  * Simplifying mDNS configuration and updating documentation.
  * Changed DBus rules to only block setting properties
  * Restrict the Dbus "deny" rules to only the debug interface.</changelog>
  <changelog author="dimstar@opensuse.org" date="1646308800">- Add gobject-introspection BuildRequires: enable typelib
  introspection. This allows RPM to add a bunch of autodetected
  dependenices by inspecting the python scripts (basedon
  python-gobject).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308801">- Correct License information. This project is licenced under
  Apache License 2.0.
- Mark sys.conf.doc as config file.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648036800">- Update to version 1.0-rc4:
  * Check ignore-iface when creating TransportId object
  * Adding man pages for ip-family and ignore-iface
  * Add ignore-iface and ip-family conf. options
  * Update the documentation
  * Change default address returned by name resolver
  * Filter out invalid IP addresses. (bsc#1197361)
  * When reading the Host NQN, warn people if the NQN seems invalid
  * Print descriptive message when unable to run stafctl/stacctl
  * Use the newly added cntlrtype to check the type of controller
  * minor fix to previous change to set the log level on libnvme
  * LOG: enable libnvme debug when trace is enabled
- Added python3-netifaces dependency</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648209600">- Update to version 1.0-rc5:
  * Remove misconfiguration check. (bsc#1197361)
  * Document how to increase the number of interfaces that Avahi can monitor.
- Removed python3-netifaces dependency (bsc#1197361)
- Added ahahi dependency
- Do not list files twice (add %dir to directory paths)
- Drop workaround for Python interpreter path fixup.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649246400">- Update to version v1.0:
  * Do not call persistent_set() from libnvme
  * dbus: return native dbus data instead of json when possible.
  * update documentation</changelog>
  <changelog author="mwilck@suse.com" date="1656936000">- Update to version 1.1.5 (bsc#1200128)
  Bug fix release
  * udev: fix I/O controller scan &amp; detect algorithm
  * stacd: Fix D-Bus race condition between stacd and stafd.
  * staslib: fix support for fibre channel
  * doc: update README.md
  * staslib: fix race conditions during controller object removal.
  * stacd: fix defered call to remove_controller() with wrong arguments
  * staslib: make sure controller object gets "purged" when removed.
  * staslib: calling wrong cback function on controller removal.
  * staslib: Fix cback function deleting object that called the cback.
  * stacd: audit connections
  * stafd, stacd: Add man page to systend service file.
  * stacd: Add configuration parameter 'sticky-connections'
  * doc: troubleshoot guide for missing mDNS packets
  * stacd: allow disabling nvme-cli auto-connect udev rule.
- Added systemd service file (service disabled)
- Spec file: use %python_sitelib rather than %python_sitearch, and install
  everything under %{python_sitelib}/staslib</changelog>
  <changelog author="mwilck@suse.com" date="1659960000">- Update to version 1.1.6:
  Bug fix release
  * conf: Enable sticky-connections by default
  * staslib: check that async operation hasn't been cancelled before proceeding
  * stacd: fix I/O controller connection audits
  * staslib: add override support
  * systemd: add explicit dependency to modprobe@nvme_fabrics.service</changelog>
  <changelog author="mwilck@suse.com" date="1668513600">- Update to version 1.1.7:
  * staslib: Trim white spaces from DLPEs and manual configuration.
  (bsc#1204975)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 2.0 (jsc#PED-2487)
  * stafd: Add support for PLEO bit ("Port Local Entries Only",
  only with libnvme 1.2 or higher)
  * Add support for NCC bit ("Not Connected to CDC")
  * "sticky-connections" is replaced by "disconnect-scope+disconnect-trtypes"
  * "blacklist" is replaced by "exclude" (but still supported)
  * better udev support / coexistence
  * support for new kernel "src_addr" attribute
  * add patch: 0001-meson-disable-subproject.patch (to fix build in OBS)</changelog>
  <changelog author="mwilck@suse.com" date="1670932800">- Update to version 2.1:
  * stafd: Add zeroconf-connections-persistence conf. parameter
  * Avahi: Handle upper/lower case 'NQN/nqn' in TXT attribute
    (bsc#1205873)
  * stafd: Add "origin" parameter to DC controller objects
  * staslib: Trim whitespaces at the source (bsc#1204975)
  * udev: Throttle EnvironmentError exception messages
  * del patch: 0001-meson-disable-subproject.patch (not necessary any more)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 2.1.2:
  * staslib: fix RoCE support (bsc#1207436)
  * staslib: Only display unresponsive timer info for "discovered" DCs
  * staslib: Fix Connect/Disconnect performed in reserve order
  * udev: Set udev event priority to high
  * stafd: Bug fix. Default "[Global] persistent-connections=false"
  * stafd: Handle unresponsive DCs in _config_ctrls_finish()
  * stafd: Fix handling of lost zeroconf-discovered DC
  * staslib: Improve name resolution algorithm
  * staslib: Add unit (sec) to timeout value in info() output</changelog>
  <changelog author="mwilck@suse.com" date="1680264000">- Update to version 2.2:
  * add DHCHAP support for in-band authentication (bsc#1208580)
  * staslib: Define LIBNVME_VERSION in defs.py
  * staslib: Disable udev-rule permanently
  * build: Change libnvme dependency from 1.2 to 1.3</changelog>
</package>
<package pkgid="d1bebde911c5431429e3c3063bcbf60a4ed48f755eb40656bae0bbe138f6fca4" name="nvme-stas" arch="ppc64le">
  <version epoch="0" ver="2.2" rel="150500.3.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1643284800">- Initial nvme-stas packaging</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645012800">- Update to version 1.0-rc1:
  * fix comment
  * Perform explicit registration from user-space
  * Add known image to docker-compose
  * Add docker run/build way to README
  * Actions: Disable actions/setup-python
  * Actions: Work on incoming branch
  * Fixing docker compilation error
  * Update docker-publish.yml
  * Fix github workflow
  * removed unused code
  * D-Bus config fixes.
  * github workflow actions - fix PYTHONPATH</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645617600">- Update to version 1.0-rc2:
  * Fis github workflows to pull from upstream libnvme
  * TP8010 was merged into upstream libnvme. Some APIs have changed.
    This is to update nvme-stas to the new APIs.
  * A bunch of mostly cosmetic changes
  * Cleaning up a few things.
  * Simplifying mDNS configuration and updating documentation.
  * Changed DBus rules to only block setting properties
  * Restrict the Dbus "deny" rules to only the debug interface.</changelog>
  <changelog author="dimstar@opensuse.org" date="1646308800">- Add gobject-introspection BuildRequires: enable typelib
  introspection. This allows RPM to add a bunch of autodetected
  dependenices by inspecting the python scripts (basedon
  python-gobject).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308801">- Correct License information. This project is licenced under
  Apache License 2.0.
- Mark sys.conf.doc as config file.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648036800">- Update to version 1.0-rc4:
  * Check ignore-iface when creating TransportId object
  * Adding man pages for ip-family and ignore-iface
  * Add ignore-iface and ip-family conf. options
  * Update the documentation
  * Change default address returned by name resolver
  * Filter out invalid IP addresses. (bsc#1197361)
  * When reading the Host NQN, warn people if the NQN seems invalid
  * Print descriptive message when unable to run stafctl/stacctl
  * Use the newly added cntlrtype to check the type of controller
  * minor fix to previous change to set the log level on libnvme
  * LOG: enable libnvme debug when trace is enabled
- Added python3-netifaces dependency</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648209600">- Update to version 1.0-rc5:
  * Remove misconfiguration check. (bsc#1197361)
  * Document how to increase the number of interfaces that Avahi can monitor.
- Removed python3-netifaces dependency (bsc#1197361)
- Added ahahi dependency
- Do not list files twice (add %dir to directory paths)
- Drop workaround for Python interpreter path fixup.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649246400">- Update to version v1.0:
  * Do not call persistent_set() from libnvme
  * dbus: return native dbus data instead of json when possible.
  * update documentation</changelog>
  <changelog author="mwilck@suse.com" date="1656936000">- Update to version 1.1.5 (bsc#1200128)
  Bug fix release
  * udev: fix I/O controller scan &amp; detect algorithm
  * stacd: Fix D-Bus race condition between stacd and stafd.
  * staslib: fix support for fibre channel
  * doc: update README.md
  * staslib: fix race conditions during controller object removal.
  * stacd: fix defered call to remove_controller() with wrong arguments
  * staslib: make sure controller object gets "purged" when removed.
  * staslib: calling wrong cback function on controller removal.
  * staslib: Fix cback function deleting object that called the cback.
  * stacd: audit connections
  * stafd, stacd: Add man page to systend service file.
  * stacd: Add configuration parameter 'sticky-connections'
  * doc: troubleshoot guide for missing mDNS packets
  * stacd: allow disabling nvme-cli auto-connect udev rule.
- Added systemd service file (service disabled)
- Spec file: use %python_sitelib rather than %python_sitearch, and install
  everything under %{python_sitelib}/staslib</changelog>
  <changelog author="mwilck@suse.com" date="1659960000">- Update to version 1.1.6:
  Bug fix release
  * conf: Enable sticky-connections by default
  * staslib: check that async operation hasn't been cancelled before proceeding
  * stacd: fix I/O controller connection audits
  * staslib: add override support
  * systemd: add explicit dependency to modprobe@nvme_fabrics.service</changelog>
  <changelog author="mwilck@suse.com" date="1668513600">- Update to version 1.1.7:
  * staslib: Trim white spaces from DLPEs and manual configuration.
  (bsc#1204975)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 2.0 (jsc#PED-2487)
  * stafd: Add support for PLEO bit ("Port Local Entries Only",
  only with libnvme 1.2 or higher)
  * Add support for NCC bit ("Not Connected to CDC")
  * "sticky-connections" is replaced by "disconnect-scope+disconnect-trtypes"
  * "blacklist" is replaced by "exclude" (but still supported)
  * better udev support / coexistence
  * support for new kernel "src_addr" attribute
  * add patch: 0001-meson-disable-subproject.patch (to fix build in OBS)</changelog>
  <changelog author="mwilck@suse.com" date="1670932800">- Update to version 2.1:
  * stafd: Add zeroconf-connections-persistence conf. parameter
  * Avahi: Handle upper/lower case 'NQN/nqn' in TXT attribute
    (bsc#1205873)
  * stafd: Add "origin" parameter to DC controller objects
  * staslib: Trim whitespaces at the source (bsc#1204975)
  * udev: Throttle EnvironmentError exception messages
  * del patch: 0001-meson-disable-subproject.patch (not necessary any more)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 2.1.2:
  * staslib: fix RoCE support (bsc#1207436)
  * staslib: Only display unresponsive timer info for "discovered" DCs
  * staslib: Fix Connect/Disconnect performed in reserve order
  * udev: Set udev event priority to high
  * stafd: Bug fix. Default "[Global] persistent-connections=false"
  * stafd: Handle unresponsive DCs in _config_ctrls_finish()
  * stafd: Fix handling of lost zeroconf-discovered DC
  * staslib: Improve name resolution algorithm
  * staslib: Add unit (sec) to timeout value in info() output</changelog>
  <changelog author="mwilck@suse.com" date="1680264000">- Update to version 2.2:
  * add DHCHAP support for in-band authentication (bsc#1208580)
  * staslib: Define LIBNVME_VERSION in defs.py
  * staslib: Disable udev-rule permanently
  * build: Change libnvme dependency from 1.2 to 1.3</changelog>
</package>
<package pkgid="e9f0c35e1dc48be27b5b69984e2bc33bb914e23dd820925b07306fae9255b34a" name="nvme-stas" arch="s390x">
  <version epoch="0" ver="2.2" rel="150500.3.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1643284800">- Initial nvme-stas packaging</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645012800">- Update to version 1.0-rc1:
  * fix comment
  * Perform explicit registration from user-space
  * Add known image to docker-compose
  * Add docker run/build way to README
  * Actions: Disable actions/setup-python
  * Actions: Work on incoming branch
  * Fixing docker compilation error
  * Update docker-publish.yml
  * Fix github workflow
  * removed unused code
  * D-Bus config fixes.
  * github workflow actions - fix PYTHONPATH</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645617600">- Update to version 1.0-rc2:
  * Fis github workflows to pull from upstream libnvme
  * TP8010 was merged into upstream libnvme. Some APIs have changed.
    This is to update nvme-stas to the new APIs.
  * A bunch of mostly cosmetic changes
  * Cleaning up a few things.
  * Simplifying mDNS configuration and updating documentation.
  * Changed DBus rules to only block setting properties
  * Restrict the Dbus "deny" rules to only the debug interface.</changelog>
  <changelog author="dimstar@opensuse.org" date="1646308800">- Add gobject-introspection BuildRequires: enable typelib
  introspection. This allows RPM to add a bunch of autodetected
  dependenices by inspecting the python scripts (basedon
  python-gobject).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308801">- Correct License information. This project is licenced under
  Apache License 2.0.
- Mark sys.conf.doc as config file.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648036800">- Update to version 1.0-rc4:
  * Check ignore-iface when creating TransportId object
  * Adding man pages for ip-family and ignore-iface
  * Add ignore-iface and ip-family conf. options
  * Update the documentation
  * Change default address returned by name resolver
  * Filter out invalid IP addresses. (bsc#1197361)
  * When reading the Host NQN, warn people if the NQN seems invalid
  * Print descriptive message when unable to run stafctl/stacctl
  * Use the newly added cntlrtype to check the type of controller
  * minor fix to previous change to set the log level on libnvme
  * LOG: enable libnvme debug when trace is enabled
- Added python3-netifaces dependency</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648209600">- Update to version 1.0-rc5:
  * Remove misconfiguration check. (bsc#1197361)
  * Document how to increase the number of interfaces that Avahi can monitor.
- Removed python3-netifaces dependency (bsc#1197361)
- Added ahahi dependency
- Do not list files twice (add %dir to directory paths)
- Drop workaround for Python interpreter path fixup.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649246400">- Update to version v1.0:
  * Do not call persistent_set() from libnvme
  * dbus: return native dbus data instead of json when possible.
  * update documentation</changelog>
  <changelog author="mwilck@suse.com" date="1656936000">- Update to version 1.1.5 (bsc#1200128)
  Bug fix release
  * udev: fix I/O controller scan &amp; detect algorithm
  * stacd: Fix D-Bus race condition between stacd and stafd.
  * staslib: fix support for fibre channel
  * doc: update README.md
  * staslib: fix race conditions during controller object removal.
  * stacd: fix defered call to remove_controller() with wrong arguments
  * staslib: make sure controller object gets "purged" when removed.
  * staslib: calling wrong cback function on controller removal.
  * staslib: Fix cback function deleting object that called the cback.
  * stacd: audit connections
  * stafd, stacd: Add man page to systend service file.
  * stacd: Add configuration parameter 'sticky-connections'
  * doc: troubleshoot guide for missing mDNS packets
  * stacd: allow disabling nvme-cli auto-connect udev rule.
- Added systemd service file (service disabled)
- Spec file: use %python_sitelib rather than %python_sitearch, and install
  everything under %{python_sitelib}/staslib</changelog>
  <changelog author="mwilck@suse.com" date="1659960000">- Update to version 1.1.6:
  Bug fix release
  * conf: Enable sticky-connections by default
  * staslib: check that async operation hasn't been cancelled before proceeding
  * stacd: fix I/O controller connection audits
  * staslib: add override support
  * systemd: add explicit dependency to modprobe@nvme_fabrics.service</changelog>
  <changelog author="mwilck@suse.com" date="1668513600">- Update to version 1.1.7:
  * staslib: Trim white spaces from DLPEs and manual configuration.
  (bsc#1204975)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 2.0 (jsc#PED-2487)
  * stafd: Add support for PLEO bit ("Port Local Entries Only",
  only with libnvme 1.2 or higher)
  * Add support for NCC bit ("Not Connected to CDC")
  * "sticky-connections" is replaced by "disconnect-scope+disconnect-trtypes"
  * "blacklist" is replaced by "exclude" (but still supported)
  * better udev support / coexistence
  * support for new kernel "src_addr" attribute
  * add patch: 0001-meson-disable-subproject.patch (to fix build in OBS)</changelog>
  <changelog author="mwilck@suse.com" date="1670932800">- Update to version 2.1:
  * stafd: Add zeroconf-connections-persistence conf. parameter
  * Avahi: Handle upper/lower case 'NQN/nqn' in TXT attribute
    (bsc#1205873)
  * stafd: Add "origin" parameter to DC controller objects
  * staslib: Trim whitespaces at the source (bsc#1204975)
  * udev: Throttle EnvironmentError exception messages
  * del patch: 0001-meson-disable-subproject.patch (not necessary any more)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 2.1.2:
  * staslib: fix RoCE support (bsc#1207436)
  * staslib: Only display unresponsive timer info for "discovered" DCs
  * staslib: Fix Connect/Disconnect performed in reserve order
  * udev: Set udev event priority to high
  * stafd: Bug fix. Default "[Global] persistent-connections=false"
  * stafd: Handle unresponsive DCs in _config_ctrls_finish()
  * stafd: Fix handling of lost zeroconf-discovered DC
  * staslib: Improve name resolution algorithm
  * staslib: Add unit (sec) to timeout value in info() output</changelog>
  <changelog author="mwilck@suse.com" date="1680264000">- Update to version 2.2:
  * add DHCHAP support for in-band authentication (bsc#1208580)
  * staslib: Define LIBNVME_VERSION in defs.py
  * staslib: Disable udev-rule permanently
  * build: Change libnvme dependency from 1.2 to 1.3</changelog>
</package>
<package pkgid="cc32af03c67f6672220742d2b6934eb6a385ecc023ff38fe10f36e948453b221" name="nvme-stas" arch="src">
  <version epoch="0" ver="2.2" rel="150500.3.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1643284800">- Initial nvme-stas packaging</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645012800">- Update to version 1.0-rc1:
  * fix comment
  * Perform explicit registration from user-space
  * Add known image to docker-compose
  * Add docker run/build way to README
  * Actions: Disable actions/setup-python
  * Actions: Work on incoming branch
  * Fixing docker compilation error
  * Update docker-publish.yml
  * Fix github workflow
  * removed unused code
  * D-Bus config fixes.
  * github workflow actions - fix PYTHONPATH</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645617600">- Update to version 1.0-rc2:
  * Fis github workflows to pull from upstream libnvme
  * TP8010 was merged into upstream libnvme. Some APIs have changed.
    This is to update nvme-stas to the new APIs.
  * A bunch of mostly cosmetic changes
  * Cleaning up a few things.
  * Simplifying mDNS configuration and updating documentation.
  * Changed DBus rules to only block setting properties
  * Restrict the Dbus "deny" rules to only the debug interface.</changelog>
  <changelog author="dimstar@opensuse.org" date="1646308800">- Add gobject-introspection BuildRequires: enable typelib
  introspection. This allows RPM to add a bunch of autodetected
  dependenices by inspecting the python scripts (basedon
  python-gobject).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308801">- Correct License information. This project is licenced under
  Apache License 2.0.
- Mark sys.conf.doc as config file.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648036800">- Update to version 1.0-rc4:
  * Check ignore-iface when creating TransportId object
  * Adding man pages for ip-family and ignore-iface
  * Add ignore-iface and ip-family conf. options
  * Update the documentation
  * Change default address returned by name resolver
  * Filter out invalid IP addresses. (bsc#1197361)
  * When reading the Host NQN, warn people if the NQN seems invalid
  * Print descriptive message when unable to run stafctl/stacctl
  * Use the newly added cntlrtype to check the type of controller
  * minor fix to previous change to set the log level on libnvme
  * LOG: enable libnvme debug when trace is enabled
- Added python3-netifaces dependency</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648209600">- Update to version 1.0-rc5:
  * Remove misconfiguration check. (bsc#1197361)
  * Document how to increase the number of interfaces that Avahi can monitor.
- Removed python3-netifaces dependency (bsc#1197361)
- Added ahahi dependency
- Do not list files twice (add %dir to directory paths)
- Drop workaround for Python interpreter path fixup.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649246400">- Update to version v1.0:
  * Do not call persistent_set() from libnvme
  * dbus: return native dbus data instead of json when possible.
  * update documentation</changelog>
  <changelog author="mwilck@suse.com" date="1656936000">- Update to version 1.1.5 (bsc#1200128)
  Bug fix release
  * udev: fix I/O controller scan &amp; detect algorithm
  * stacd: Fix D-Bus race condition between stacd and stafd.
  * staslib: fix support for fibre channel
  * doc: update README.md
  * staslib: fix race conditions during controller object removal.
  * stacd: fix defered call to remove_controller() with wrong arguments
  * staslib: make sure controller object gets "purged" when removed.
  * staslib: calling wrong cback function on controller removal.
  * staslib: Fix cback function deleting object that called the cback.
  * stacd: audit connections
  * stafd, stacd: Add man page to systend service file.
  * stacd: Add configuration parameter 'sticky-connections'
  * doc: troubleshoot guide for missing mDNS packets
  * stacd: allow disabling nvme-cli auto-connect udev rule.
- Added systemd service file (service disabled)
- Spec file: use %python_sitelib rather than %python_sitearch, and install
  everything under %{python_sitelib}/staslib</changelog>
  <changelog author="mwilck@suse.com" date="1659960000">- Update to version 1.1.6:
  Bug fix release
  * conf: Enable sticky-connections by default
  * staslib: check that async operation hasn't been cancelled before proceeding
  * stacd: fix I/O controller connection audits
  * staslib: add override support
  * systemd: add explicit dependency to modprobe@nvme_fabrics.service</changelog>
  <changelog author="mwilck@suse.com" date="1668513600">- Update to version 1.1.7:
  * staslib: Trim white spaces from DLPEs and manual configuration.
  (bsc#1204975)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 2.0 (jsc#PED-2487)
  * stafd: Add support for PLEO bit ("Port Local Entries Only",
  only with libnvme 1.2 or higher)
  * Add support for NCC bit ("Not Connected to CDC")
  * "sticky-connections" is replaced by "disconnect-scope+disconnect-trtypes"
  * "blacklist" is replaced by "exclude" (but still supported)
  * better udev support / coexistence
  * support for new kernel "src_addr" attribute
  * add patch: 0001-meson-disable-subproject.patch (to fix build in OBS)</changelog>
  <changelog author="mwilck@suse.com" date="1670932800">- Update to version 2.1:
  * stafd: Add zeroconf-connections-persistence conf. parameter
  * Avahi: Handle upper/lower case 'NQN/nqn' in TXT attribute
    (bsc#1205873)
  * stafd: Add "origin" parameter to DC controller objects
  * staslib: Trim whitespaces at the source (bsc#1204975)
  * udev: Throttle EnvironmentError exception messages
  * del patch: 0001-meson-disable-subproject.patch (not necessary any more)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 2.1.2:
  * staslib: fix RoCE support (bsc#1207436)
  * staslib: Only display unresponsive timer info for "discovered" DCs
  * staslib: Fix Connect/Disconnect performed in reserve order
  * udev: Set udev event priority to high
  * stafd: Bug fix. Default "[Global] persistent-connections=false"
  * stafd: Handle unresponsive DCs in _config_ctrls_finish()
  * stafd: Fix handling of lost zeroconf-discovered DC
  * staslib: Improve name resolution algorithm
  * staslib: Add unit (sec) to timeout value in info() output</changelog>
  <changelog author="mwilck@suse.com" date="1680264000">- Update to version 2.2:
  * add DHCHAP support for in-band authentication (bsc#1208580)
  * staslib: Define LIBNVME_VERSION in defs.py
  * staslib: Disable udev-rule permanently
  * build: Change libnvme dependency from 1.2 to 1.3</changelog>
</package>
<package pkgid="338d52a5263706de963a4a5a55a882b3447997036b1443489a4d77076e42742c" name="nvme-stas" arch="x86_64">
  <version epoch="0" ver="2.2" rel="150500.3.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1643284800">- Initial nvme-stas packaging</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645012800">- Update to version 1.0-rc1:
  * fix comment
  * Perform explicit registration from user-space
  * Add known image to docker-compose
  * Add docker run/build way to README
  * Actions: Disable actions/setup-python
  * Actions: Work on incoming branch
  * Fixing docker compilation error
  * Update docker-publish.yml
  * Fix github workflow
  * removed unused code
  * D-Bus config fixes.
  * github workflow actions - fix PYTHONPATH</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645617600">- Update to version 1.0-rc2:
  * Fis github workflows to pull from upstream libnvme
  * TP8010 was merged into upstream libnvme. Some APIs have changed.
    This is to update nvme-stas to the new APIs.
  * A bunch of mostly cosmetic changes
  * Cleaning up a few things.
  * Simplifying mDNS configuration and updating documentation.
  * Changed DBus rules to only block setting properties
  * Restrict the Dbus "deny" rules to only the debug interface.</changelog>
  <changelog author="dimstar@opensuse.org" date="1646308800">- Add gobject-introspection BuildRequires: enable typelib
  introspection. This allows RPM to add a bunch of autodetected
  dependenices by inspecting the python scripts (basedon
  python-gobject).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308801">- Correct License information. This project is licenced under
  Apache License 2.0.
- Mark sys.conf.doc as config file.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648036800">- Update to version 1.0-rc4:
  * Check ignore-iface when creating TransportId object
  * Adding man pages for ip-family and ignore-iface
  * Add ignore-iface and ip-family conf. options
  * Update the documentation
  * Change default address returned by name resolver
  * Filter out invalid IP addresses. (bsc#1197361)
  * When reading the Host NQN, warn people if the NQN seems invalid
  * Print descriptive message when unable to run stafctl/stacctl
  * Use the newly added cntlrtype to check the type of controller
  * minor fix to previous change to set the log level on libnvme
  * LOG: enable libnvme debug when trace is enabled
- Added python3-netifaces dependency</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648209600">- Update to version 1.0-rc5:
  * Remove misconfiguration check. (bsc#1197361)
  * Document how to increase the number of interfaces that Avahi can monitor.
- Removed python3-netifaces dependency (bsc#1197361)
- Added ahahi dependency
- Do not list files twice (add %dir to directory paths)
- Drop workaround for Python interpreter path fixup.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649246400">- Update to version v1.0:
  * Do not call persistent_set() from libnvme
  * dbus: return native dbus data instead of json when possible.
  * update documentation</changelog>
  <changelog author="mwilck@suse.com" date="1656936000">- Update to version 1.1.5 (bsc#1200128)
  Bug fix release
  * udev: fix I/O controller scan &amp; detect algorithm
  * stacd: Fix D-Bus race condition between stacd and stafd.
  * staslib: fix support for fibre channel
  * doc: update README.md
  * staslib: fix race conditions during controller object removal.
  * stacd: fix defered call to remove_controller() with wrong arguments
  * staslib: make sure controller object gets "purged" when removed.
  * staslib: calling wrong cback function on controller removal.
  * staslib: Fix cback function deleting object that called the cback.
  * stacd: audit connections
  * stafd, stacd: Add man page to systend service file.
  * stacd: Add configuration parameter 'sticky-connections'
  * doc: troubleshoot guide for missing mDNS packets
  * stacd: allow disabling nvme-cli auto-connect udev rule.
- Added systemd service file (service disabled)
- Spec file: use %python_sitelib rather than %python_sitearch, and install
  everything under %{python_sitelib}/staslib</changelog>
  <changelog author="mwilck@suse.com" date="1659960000">- Update to version 1.1.6:
  Bug fix release
  * conf: Enable sticky-connections by default
  * staslib: check that async operation hasn't been cancelled before proceeding
  * stacd: fix I/O controller connection audits
  * staslib: add override support
  * systemd: add explicit dependency to modprobe@nvme_fabrics.service</changelog>
  <changelog author="mwilck@suse.com" date="1668513600">- Update to version 1.1.7:
  * staslib: Trim white spaces from DLPEs and manual configuration.
  (bsc#1204975)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 2.0 (jsc#PED-2487)
  * stafd: Add support for PLEO bit ("Port Local Entries Only",
  only with libnvme 1.2 or higher)
  * Add support for NCC bit ("Not Connected to CDC")
  * "sticky-connections" is replaced by "disconnect-scope+disconnect-trtypes"
  * "blacklist" is replaced by "exclude" (but still supported)
  * better udev support / coexistence
  * support for new kernel "src_addr" attribute
  * add patch: 0001-meson-disable-subproject.patch (to fix build in OBS)</changelog>
  <changelog author="mwilck@suse.com" date="1670932800">- Update to version 2.1:
  * stafd: Add zeroconf-connections-persistence conf. parameter
  * Avahi: Handle upper/lower case 'NQN/nqn' in TXT attribute
    (bsc#1205873)
  * stafd: Add "origin" parameter to DC controller objects
  * staslib: Trim whitespaces at the source (bsc#1204975)
  * udev: Throttle EnvironmentError exception messages
  * del patch: 0001-meson-disable-subproject.patch (not necessary any more)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 2.1.2:
  * staslib: fix RoCE support (bsc#1207436)
  * staslib: Only display unresponsive timer info for "discovered" DCs
  * staslib: Fix Connect/Disconnect performed in reserve order
  * udev: Set udev event priority to high
  * stafd: Bug fix. Default "[Global] persistent-connections=false"
  * stafd: Handle unresponsive DCs in _config_ctrls_finish()
  * stafd: Fix handling of lost zeroconf-discovered DC
  * staslib: Improve name resolution algorithm
  * staslib: Add unit (sec) to timeout value in info() output</changelog>
  <changelog author="mwilck@suse.com" date="1680264000">- Update to version 2.2:
  * add DHCHAP support for in-band authentication (bsc#1208580)
  * staslib: Define LIBNVME_VERSION in defs.py
  * staslib: Disable udev-rule permanently
  * build: Change libnvme dependency from 1.2 to 1.3</changelog>
</package>
<package pkgid="09dc7cbe69e7c47f805469f3f56e0c0a5aa696447fc800753bae20605ddb383e" name="openldap2" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="f3d54175b9da440b7a3b02d06a99383fe4808ea775996bd6a2aa51951432c8c1" name="openldap2" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="7bd001195005cf9f32467bb885289127a0a1067a27c5d28664a47d27c5db8a20" name="openldap2" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="9b7b71834503d22076ed5d7bf274a480a8ccd0a4db2da16053757ab8eeabb856" name="openldap2" arch="src">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="0f1c614aa181513d0d49547f65657fe26429f9080887fe7e073987cb53cc973c" name="openldap2" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="8da5b77d22af8a2200bb1f9454528f6674b036fd03ab32d7781e8b52953fdc46" name="openldap2-back-meta" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="4bb302b2f3c58061ded7e79875dccbdd49e6f74c0c8b8b0baa3e78df642182a1" name="openldap2-back-meta" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="6a7173d325cb5ee18661a8d1e84358bb4a3ccca790e8bf2fd285f77e5fca3940" name="openldap2-back-meta" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="4bc19557f989ac8f5b19ac1974c81aa0841ce32e0445d3062ad26e20ed02b228" name="openldap2-back-meta" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="6d539e90208bc8ef0af691eea9c4db205ad2ab300376abbd244695b0387435ee" name="openldap2-back-perl" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="0b46e13ec352347429fe630ed16fcc31fda747172ea9cc1263dbf1abcfa648fa" name="openldap2-back-perl" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="70daa4cab345bfabad395e74e20d022bdaa7432ebe1d2a20efda7788fa89bfd0" name="openldap2-back-perl" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="b4859444ca41fa7338640e2c76fbee94a89174956dc7b7c82d0573cc0886ad0e" name="openldap2-back-perl" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="c9ff5311194e94115d46abf6655089aeecc0a1911324ada0ebae800cdc58107b" name="openldap2-back-sock" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="64f0a3568fed5b01fc6a84f2a45cafad46089e100855116c75028b2c7723790e" name="openldap2-back-sock" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="072cc8b7982232d7750de92ce24cd03a215fb32b633e7857af18a5dfb57f4823" name="openldap2-back-sock" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="8577042245eadb6280e45a4fac57ca514b4cd0affa65c992c38f0b5c19964480" name="openldap2-back-sock" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="74bb744fbbc831ad30a22f60e4b258d11bec97caa3c63b439542ccdb3d163dfb" name="openldap2-back-sql" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="930d82555f798255103a2f8502ded96c124f7212b67ce200ae98f558c6af2e54" name="openldap2-back-sql" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="fdabfcf3ebad49ea0f1d05883b22db98da158eab34c7d824abb3349b1b89e20d" name="openldap2-back-sql" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="c43c443f0ba1093fed12a629f688b7301229b5941d3b8d47a6d2cb25a57cfe57" name="openldap2-back-sql" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="a355707b17de0d496400639661bb51bac1af0eeabc0c58d13d78f4727f783356" name="openldap2-client" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="5cfa41ad4a6e39c8a1b1692c2425ae85357423d879b4ec63d3ba98f48c29b11f" name="openldap2-client" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="5c35314217d0fe17a37865c12ce31ab4e439058e25c8dca5ea16d48aab43285d" name="openldap2-client" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="45e0f979fd5e5d8c3ab6161538acc330f52dfa22c57cd94b49b9733ec5f4ab58" name="openldap2-client" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="c7233d02e850da6f551b422ab59eaaec50fe949c8847688751d0efae5e1275bc" name="openldap2-contrib" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="be29235e0e87e35f63cf6d63317c7193e9b9c5bb6820355c6bf31537ebc33e25" name="openldap2-contrib" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="95de6c611278a2a246545f6840e3eaf6eb7ac10a77a5418433b01ed7a47dc42c" name="openldap2-contrib" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="5eef4edd909ee78bf2648a52b857489e266ff8613977f1a2571edde6d99d6d6b" name="openldap2-contrib" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="110fa348df91c5bdb43c39afed84eed7eedf75289512e8343286a4fb1d17f746" name="openldap2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="9317afaa42585ee5fa8be80ab6291a3afc5b08bdb8bcddabc7f6dff5948958e3" name="openldap2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="6ae11af8c380bb3ac0c3d53f4bb284afce73a90f7c88728007d1ec2a3d9613bd" name="openldap2-devel" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="658fc692c80661bae9c93c27eb7a1a02d104807e2d725bb5ecf1bfe011b8ea6e" name="openldap2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="26dbbc321c6f3323e90ff1cb1648d8fbfc3e407fa49dcfbd056be08648482ab4" name="openldap2-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="41f65560ec51af3d131c4b874c318cc8e3ee3d40286cb2b4cb03104cef4a9be9" name="openldap2-devel-static" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="46b1686eb8545d0b3b0378f5fb45d0dca2b4df9a6ea694bc0c718bee3820634e" name="openldap2-devel-static" arch="ppc64le">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="e05949a4fd30c0842f4bfac92e4c69d14557e5ccc9d0928bf191d317d6500c26" name="openldap2-devel-static" arch="s390x">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="9ea560040de22ed0394cf76eca6ec509fe0016a7a884f012919b998f4d6129da" name="openldap2-devel-static" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="943ff48870394a0c368339c8d00fb60c81bd7710b7cdc52d9e501ab9c2f0850f" name="openldap2-doc" arch="noarch">
  <version epoch="0" ver="2.4.46" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="a328b9fd43ddaccf6e3b752a376cc9c127850dcbd63041f4fd8a6291933e7630" name="openldap2-ppolicy-check-password" arch="aarch64">
  <version epoch="0" ver="1.2" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="ae000d9981df41a3f456838b5aeffa2b81a54ba2c341466b3e7831c3b58f75f0" name="openldap2-ppolicy-check-password" arch="ppc64le">
  <version epoch="0" ver="1.2" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="9c4afc9b33cee494266d333c1a9b78649fcfc74f8c483b60f8ec8f465649cc43" name="openldap2-ppolicy-check-password" arch="s390x">
  <version epoch="0" ver="1.2" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="6e6185d8a0db29ee71ba7a77439dfa518f59890a3ac00f8798a7224ae30dddd0" name="openldap2-ppolicy-check-password" arch="x86_64">
  <version epoch="0" ver="1.2" rel="150200.14.14.1"/>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211795 - CVE-2023-2953 - Null pointer deref in ber_memalloc_x
  * 0244-ITS-9904-ldif_open_url-check-for-ber_strdup-failure.patch</changelog>
</package>
<package pkgid="3c3e54832a146c16fd5e2604d67966ff82eec46c877b6849fe8de30181598439" name="opensc" arch="aarch64">
  <version epoch="0" ver="0.22.0" rel="150400.3.3.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
</package>
<package pkgid="d904036525009739f75bcaaa5599b307910c1044c9b6287c3860b2b90913c10b" name="opensc" arch="ppc64le">
  <version epoch="0" ver="0.22.0" rel="150400.3.3.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
</package>
<package pkgid="b1744dcd409c300c85eea6a8ce44cb8daf611a7beaa862b88771ae4df11c0cc9" name="opensc" arch="s390x">
  <version epoch="0" ver="0.22.0" rel="150400.3.3.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
</package>
<package pkgid="3f0add7bd7aea75b486327bec3b3e201ec24cad0c7d8ee744c13500ef1237c31" name="opensc" arch="src">
  <version epoch="0" ver="0.22.0" rel="150400.3.3.1"/>
  <changelog author="sbrabec@suse.cz" date="1294401600">- Updated to version 0.12.0:
  * Security fix (bnc#660109, CVE-2010-4523).
  * Only one backend is supported. openSUSE will use pcsc-lite.
  * libopensc made private, library should not be used by other
    applications. Please use generic PKCS#11 interface instead.
  * Signer plugin discontinued. Please use openssl engine_pkcs11.
  * No more depends on libassuan.
  * New card drivers.
  * Support for CardOS enhanced.
  * More changes and enhancements.
- libopensc merged back to the main package, as it is private now.</changelog>
  <changelog author="lmedinas@opensuse.org" date="1317297600">- Updated to version 0.12.2:
  * Builds are now silent by default when OpenSC is built from
    source on Unix.
  * Using --wait with command line tools works with 64bit Linux
    again.
  * Greatly improved OpenPGP card support, including OpenPGP
    2.0 cards like the one found in German Privacy Foundation
    CryptoStick.
  * Fixed support for FINeID cards issued after 01.03.2011 with
    2048bit keys.
  * #256: Fixed support for TCOS cards (broken since 0.12.0).
  * Added support for IDKey-cards to TCOS3 driver.
  * #361: Improved PC/SC driver to fetch the maximum PIN sizes
    from the open source CCID driver. This fixes the issue for
    Linux/OSX with recent driver.
  * Fix FINeID cards for organizations.
  * Several smaller bugs and compiler warnings fixed
- Updated to version 0.12.1:
  * IAS-ECC 1.0.1
  * Support for cards with multiple PKCS#15 applications
  * New card driver: IAS/ECC 1.0.1
  * rutoken-tool has been deprecated and removed.
  * eidenv and piv-tool utilities now have manual pages.
  * pkcs11-tool now requires the use of --module parameter.
  * All tools can now use an ATR as an argument to --reader,
    to skip to the card with given ATR.
  * opensc-tool -l with -v now shows information about the
    inserted cards.
  * Creating files have an enforced upper size limit, 64K
  * Support for multiple PKCS#15 applications with different
    AID-s. PKCS#15 applications can be listed with pkcs15-tool
  - -list-applications. Binding to a specific AID with PKCS#15
    tools can be done with --aid.
  * Hex strings (like card ATR or APDU-s) can now be separated
    by space, in addition to colons.
  * Pinpad readers known to be bogus are now ignored by OpenSC.
    At the moment only "HP USB Smart Card Keyboard" is disabled.
  * Numerous compiler warnings, unused code and internal bugs
    have been eliminated.</changelog>
  <changelog author="mgorse@suse.com" date="1339502400">- make needed directories before running make install</changelog>
  <changelog author="luizluca@tre-sc.gov.br" date="1386072000">- update to version 0.13.0</changelog>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
</package>
<package pkgid="2869da9911f982948c9b5c4791b7049029655a93ff0598845fb90c1562c81dda" name="opensc" arch="x86_64">
  <version epoch="0" ver="0.22.0" rel="150400.3.3.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
</package>
<package pkgid="72f87db0faf0cf23d9200275524fbb799b3e91e8ef4973e9cec5157e15af863e" name="opensc-32bit" arch="x86_64">
  <version epoch="0" ver="0.22.0" rel="150400.3.3.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
</package>
<package pkgid="7d46e8803b4470fc02c330111a018633233a6eea368ad4ed64fd47b91a19468f" name="openssl-1_0_0" arch="aarch64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="26140cfc38d329977c1a7a879a224acef20cc053df3ebe6ea058470715037a48" name="openssl-1_0_0" arch="ppc64le">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="b19e63bacb4477c0e15ed779b65145ad1d69ea1815d38673775bc6d27e5cd8d4" name="openssl-1_0_0" arch="s390x">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="762ab8904fc0cbb9a16e722330a7635a71330ad8d7c87deac566b1845c9cca6f" name="openssl-1_0_0" arch="src">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="48d44eb049233acac74ccec0aff1c343f4164e47cf2f2806d192f4bacb3d3f33" name="openssl-1_0_0" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="f9e57096ee03e74e4f291110b551815bd0e083f38de3d7b08938a67fe4167c82" name="openssl-1_0_0-cavs" arch="aarch64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="274b392b38dd883613207cfcb78cac5c599e59692e841529119bf992192cb061" name="openssl-1_0_0-cavs" arch="ppc64le">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="2f40ed2e42c44bfab055757c9759e71c8cd9622cf6ddaf38442442a8a68f7c68" name="openssl-1_0_0-cavs" arch="s390x">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="c2d22360034db9cc8e5dc58c6211df1376f98a78c630b92dfc152500086ce22d" name="openssl-1_0_0-cavs" arch="x86_64">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="4ce224bc0ecad174500d4ccdb52fc742544cb85b424f1f4a5e7074597fddf9dc" name="openssl-1_0_0-doc" arch="noarch">
  <version epoch="0" ver="1.0.2p" rel="150000.3.76.1"/>
  <changelog author="pmonreal@suse.com" date="1602676800">- Initialize dh-&gt;nid to NID_undef in DH_new_method() [bsc#1177673]
- Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
- update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- OpenSSL Security Advisory [08 December 2020]
- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1620388800">- Add RFC3526 and RFC7919 groups to 'openssl genpkey' so that it
  can output FIPS-appropriate parameters.
  * bsc#1180995
  * openssl-add_rfc3526_rfc7919.patch</changelog>
  <changelog author="jsikes@suse.com" date="1622548800">- link binaries as position independent executables
  * openssl-1.0.0-pic-pie.patch
  * bsc#1186495</changelog>
  <changelog author="jsikes@suse.com" date="1625400000">- Change genpkey command options for bsc#1180995 to be consistent with upstream.
  * Replaced openssl-add_rfc3526_rfc7919.patch
  * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
    ffdhe* (rfc7919) groups. Example:
    $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096</changelog>
  <changelog author="jsikes@suse.com" date="1629374400">- The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="jsikes@suse.com" date="1632657600">- bsc#1190885
  * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
  * modified openssl-DH.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654776000">- Fixed error in openssl-CVE-2022-1292.patch resulting in misnamed
  variable.</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1672660800">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
  - openssl-Groundwork-for-a-perl-based-testing-framework.patch
  - openssl-Add-recipes-for-the-larger-protocols.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add openssl-CVE-2022-4304.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1676635200">- Fix DH key generation in FIPS mode, add support for constant BN for
  DH parameters [bsc#1202062]
  * Add patch: openssl-fips_fix_DH_key_generation.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
</package>
<package pkgid="a79d676b4b22aa16450249d13832e14a20098b98608f8e87adcbd58b9254c4cf" name="openvswitch" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="49ad94a82f1d9861327e84f9b25fcd25609b2e5acdd3caa6719b6c77bc6a1db0" name="openvswitch" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="a7cd2a4eb464551a2e2fd36c2aa11e317866c126a9211c6ed2b2d78cfac781e4" name="openvswitch" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="f7c589b93945d6eac5b3ab6b7871783ada67d0568f8c52d8bbc77feb55292bfc" name="openvswitch" arch="src">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="a4a2f3712d9b1eb1dc900b9c7d5d0e55dc8fdcfc72d753c41130c78caa5928ca" name="openvswitch" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="0847a2b26ed1de9c7053ef7dfd655cc572ec50f6c7fce40a1fe3dd512ff738ff" name="openvswitch-devel" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="227fc894e63920e6433f2168afee9c8fa66e03847cb2d9ef8648f3403ac6fe8f" name="openvswitch-devel" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="b5e0749db74d33df284163952598756c0fe816a967937c552e72e21f1cf62f0c" name="openvswitch-devel" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="01df387c7b9d2b3fdc83bd3525914328771d75c49abaca380254e37fc50ae8ad" name="openvswitch-devel" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="0cbf187cb64a702fb3001c008ccaefa6203a083fadccd6c5f2cfc98448004235" name="openvswitch-doc" arch="noarch">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="d0d850444bfe694579e2f0f373778224247f96fb0212e51bc295405b9feaabca" name="openvswitch-ipsec" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="806dae2e6a9b5f830259fb9c1549997ed325ef79773ae72b3530d26d24792d93" name="openvswitch-ipsec" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="f180051955fb635dce3e978243a55cb081be835d04fb9aa9f0089a75715ad132" name="openvswitch-ipsec" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="ce163cf7fca33371a8b8ce382ad0f8a65af0335c1895c15e671715a19caeaf70" name="openvswitch-ipsec" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="3f7e3e8296200a0fc67435ae6ecb7b7fcff032ecc7244338c502af209c40d23f" name="openvswitch-pki" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="4fdcda5453d8c8065861f51c13dc1af4e59d68defefbc39b0f94596adfb71c5f" name="openvswitch-pki" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="16229f0e023f8e78ea563ea43686a1cfe8537c43cae74449f4c2e1557b8d41ab" name="openvswitch-pki" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="69163f4ba783759e66384d676bff03d901a89f204a9d5420e42630fed0153a9a" name="openvswitch-pki" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="7d3cc0ae542db3014599c07258c273e64e4c67ac797af5708b8e425e9fe638bf" name="openvswitch-test" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="13bee38fca28a8db8c278c1ef1e3cb8742250124b396fd86c4bf090ea4e459ee" name="openvswitch-test" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="a6df3361c2a1244cf22185436d50bd58b90c2d4a1304e7ef5949ecae6e2f3fb7" name="openvswitch-test" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="e249f1c01a814a74236e8d65313b6739d0fd77e01626cf7da85832c0c5d44826" name="openvswitch-test" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="b4caf61afe28ebb04ceb74e765cdbb2a9d7fba06913c703f643b6c3750e54cd3" name="openvswitch-vtep" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="d38a442e899599647599d92fafaea67fc1e5c632736d683041a5609f4d21c438" name="openvswitch-vtep" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="0853329549457a9317c487624593c39752cd69ec847de024dacfe1f690d37846" name="openvswitch-vtep" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="08d2fe7e1c281a22604f5a79a512ab55f316a850fd300afe328e8a016e26528f" name="openvswitch-vtep" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="4807fc9ec8c481a729af3c6e7f109d292bb48098dcba4addfd6bd877e58ef079" name="ovn" arch="aarch64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="8f3956a08190d7e0eb70dc9f256f7b371dec18afc472b95d34c523de32bda7f7" name="ovn" arch="ppc64le">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="f11e7267b441d2fc76813bcd7aeadcf705345e85d137a9c4c324bb426047eb8b" name="ovn" arch="s390x">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="69f79f77ed87f98f4a0895acd75cfca6c2df4d9ec0e72e627d4581930972c5f5" name="ovn" arch="x86_64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="4f6334c68e80a176b6b78ed4ecbb69d35d24e413206807a48b6d52a07c621427" name="ovn-central" arch="aarch64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="7a26a6547a8a3424203f23aad24d1e3c27a49f16acd205304d33088b7cfd03fe" name="ovn-central" arch="ppc64le">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="6055ff386031c8f896960e3bd4ea61971e79cab5e348ae25520d8282487ee22e" name="ovn-central" arch="s390x">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="a7b9211f45ad353bfb0488425663e14bf88e06b881a4b9d3fed1cfb0c88be27a" name="ovn-central" arch="x86_64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="a856aa8f0e4de489a2bf794c9f655da78cfff666aa1bad64bbfc9422f14165bd" name="ovn-devel" arch="aarch64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="4f22ffb9d1dd1a507e31688874a2cdf1623bebe631dc2869cb9632132a37a566" name="ovn-devel" arch="ppc64le">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="34c346a3f03d5ff8e4abfed322d1cd9fa71709c21fc2f2d04d6f54a1654fa198" name="ovn-devel" arch="s390x">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="3797f5451846ab751d6c87c02af4926d49c2c53a5efe7e388467cdf3620ee742" name="ovn-devel" arch="x86_64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="354c07480ccb0d86d1bce168ef3911c8d7588b923f081ea221dd270914199893" name="ovn-doc" arch="noarch">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="47f4ba36ef82c909675fd30d0d80ebfc500d87a320b8800884263cee64e2eaff" name="ovn-docker" arch="aarch64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="33aa3fcc4e1f4b66dcecfbaa94dc54e298da22b03fb0f8eadd96251042c444c1" name="ovn-docker" arch="ppc64le">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="60493566b8542be11c2e3e3a6a708fe13efef766777ab20da548a9ac01253391" name="ovn-docker" arch="s390x">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="4885ae9a63e84a367058f420a5fd87e40a070f963e0595ce48bab1dad9ec7e6a" name="ovn-docker" arch="x86_64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="6eb77976a7376a434ddbdec32bc02aeba4608d52e974724157a3788228d1a6ec" name="ovn-host" arch="aarch64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="4129d6f9bb98949c7471bb68afbbc5505bfa9752890bc90762749be77ebf533b" name="ovn-host" arch="ppc64le">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="571f382a71531ce2ae60282e66ce4a3f976f5391b6cb90e02dc60c709668d75e" name="ovn-host" arch="s390x">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="020e9529da2a2ddc08482c95dffb45229d4d2862f5779fb76ce0f4f7e8c11872" name="ovn-host" arch="x86_64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="72d7bbca97abbd526b98122bfde69a1bab9fb20adf56d1635427d12b8ae879c9" name="ovn-vtep" arch="aarch64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="7e637cd30d34d945bd9052851d53fd8ac38df5dcddda1d898bbd83bcdee1565d" name="ovn-vtep" arch="ppc64le">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="dbc4f11c8fe4c625faeae5f60b1b8bd33d8620550f40f3b2e8d343b5bd258287" name="ovn-vtep" arch="s390x">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="c4eb696d65117daab29cb202eb290dd746d1b80feeba93002b84b9b8a7b79fbe" name="ovn-vtep" arch="x86_64">
  <version epoch="0" ver="20.06.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="256f8435139bb91b7652125f064e11310a2b0ce064c3a248e394f98f2fae6863" name="perl-PerlMagick" arch="aarch64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="f8d923a87f03b6b7992268f34b82bb4e4044016c8d46b28460ae4187f49b8f20" name="perl-PerlMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="11bb25a31f820bf982e484e1e265a3a2761daae58940e36f7e933931bd602e89" name="perl-PerlMagick" arch="s390x">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="5c02d3c00d545e26dab512a8ce935fb829d2537c71d4a2af5f86233ea5e0291a" name="perl-PerlMagick" arch="x86_64">
  <version epoch="0" ver="7.1.0.9" rel="150400.6.21.1"/>
  <changelog author="pgajdos@suse.com" date="1620302400">- version update to 7.0.11.11
  * FL32 no longer returns scambled results (reference
    https://github.com/ImageMagick/ImageMagick/issues/3614).
  * Ashlar pseudo-image format no longer crops labels in last row of tiles by
    default (reference https://github.com/ImageMagick/ImageMagick/issues/3618).
  * Optimize CompareImageBounds().
  * Check image is not NULL before dereferencing.
  * eliminate uninitialized value
  * Differences in computing linear gray (reference
    https://github.com/ImageMagick/ImageMagick/issues/3571).
  * added support for pdf:author, pdf:producer and pdf:title when writing a
    PDF file.</changelog>
  <changelog author="pgajdos@suse.com" date="1620648000">- version update to 7.0.11.12
  * The HEIC depth image will now only be read when the define heic:depth-image
    is true.
  * -layers optimize no longer produces broken output (reference
    https://github.com/ImageMagick/ImageMagick/issues/3520).</changelog>
  <changelog author="pgajdos@suse.com" date="1621944000">- version update to 7.0.11.13
  * Fixed reading and writing the XMP chunk in a WebP image (reference
    https://github.com/ImageMagick/ImageMagick/discussions/3617).
  * label and caption sanity check is too conservative.</changelog>
  <changelog author="pgajdos@suse.com" date="1624276800">- version update to 7.1.0.0 [bsc#1187501]
  * SVG no longer hangs when handling class in &lt;defs&gt; (reference
    https://github.com/ImageMagick/ImageMagick/issues/3818).
  * Bump minor version (reference
    https://github.com/ImageMagick/ImageMagick/issues/3768)
  * Raise exception for invalid compose:args geometry (reference
    https://github.com/ImageMagick/ImageMagick/issues/3765).
  * Added support for reading and writing 16-bit jxl images.
- modified sources
  % baselibs.conf</changelog>
  <changelog author="dmueller@suse.com" date="1627300800">- update to 7.1.0.4:
  * trim no longer returns an empty image on 1-pixel width input (reference
    https://github.com/ImageMagick/ImageMagick/issues/3896).
  * remove virtual canvas offset from difference image.
  * Added option to set the pixel format option of ffmpeg when reading a
    video file with -define video:pixel-format=&lt;value&gt;.
  * system() is not supported under IOS.
  * accelerate subimage-search with FFT's (contributed by Fred).
  * malloc() corruption fix
  * Added option to set the vsync option of ffmpeg when reading or writing a
    video file with -define video:vsync=&lt;value&gt;.</changelog>
  <changelog author="pgajdos@suse.com" date="1632139200">- version update to 7.1.0.8
  * Check for `null` in InvokeDelegate() (reference
    https://github.com/ImageMagick/ImageMagick/issues/4225).
  * Fixed incorrect check when module is used as the domain in policy.xml
    that could allow the use of a disabled module. (reference
    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr).
  * Prevent color reduction merging into one color (reference
    https://github.com/ImageMagick/ImageMagick/issues/4059)
  * Tweak the bilevel image type (reference
    https://github.com/ImageMagick/ImageMagick/issues/4121).
  * Converting from LAB to RGB leads to wrong colors (reference
    https://github.com/ImageMagick/ImageMagick/issues/4105).
  * Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
    Image and store it as a profile called dng:thumbnail.
  * Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
  * Grayscale image write optimization.</changelog>
  <changelog author="pgajdos@suse.com" date="1633348800">- version update to 7.1.0.9:
  * Squash a dump truck load of VisualStudio compiler warnings.
  * improved algorithm for automatic calculation of word breaks and pointsize
    for caption and labels.
  * improve wrapping between words and within words (reference
    https://github.com/ImageMagick/ImageMagick/discussions/4227).
- added patches
  disable Contrast test for i586 on SLE 15
  + ImageMagick-filter.t-disable-Contrast.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1633348801">- previous version updates fixed also:
  CVE-2018-10805,CVE-2018-11624,CVE-2018-11625,CVE-2018-12599,CVE-2018-12600,
  CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,
  CVE-2018-16328,CVE-2018-16329,CVE-2018-16412,CVE-2018-16413,CVE-2018-16640,
  CVE-2018-16641,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,
  CVE-2018-17966,CVE-2018-18024,CVE-2018-18544,CVE-2018-20467,CVE-2019-10650,
  CVE-2019-11007,CVE-2019-11008,CVE-2019-11470,CVE-2019-11472,CVE-2019-11505,
  CVE-2019-11506,CVE-2019-11597,CVE-2019-11598,CVE-2019-12974,CVE-2019-12975,
  CVE-2019-12976,CVE-2019-12977,CVE-2019-12978,CVE-2019-12979,CVE-2019-13133,
  CVE-2019-13134,CVE-2019-13135,CVE-2019-13136,CVE-2019-13137,CVE-2019-13295,
  CVE-2019-13296,CVE-2019-13297,CVE-2019-13298,CVE-2019-13299,CVE-2019-13300,
  CVE-2019-13301,CVE-2019-13302,CVE-2019-13303,CVE-2019-13304,CVE-2019-13305,
  CVE-2019-13306,CVE-2019-13307,CVE-2019-13308,CVE-2019-13309,CVE-2019-13310,
  CVE-2019-13311,CVE-2019-13391,CVE-2019-13454,CVE-2019-14980,CVE-2019-14981,
  CVE-2019-15139,CVE-2019-15140,CVE-2019-15141,CVE-2019-16708,CVE-2019-16709,
  CVE-2019-16710,CVE-2019-16711,CVE-2019-16712,CVE-2019-16713,CVE-2019-19948,
  CVE-2019-19949,CVE-2019-7175,CVE-2019-7395,CVE-2019-7396,CVE-2019-7397,
  CVE-2019-7398,CVE-2019-9956,CVE-2020-19667,CVE-2020-25664,CVE-2020-25665,
  CVE-2020-25666,CVE-2020-25674,CVE-2020-25675,CVE-2020-25676,CVE-2020-27560,
  CVE-2020-27750,CVE-2020-27751,CVE-2020-27752,CVE-2020-27753,CVE-2020-27754,
  CVE-2020-27755,CVE-2020-27756,CVE-2020-27757,CVE-2020-27758,CVE-2020-27759,
  CVE-2020-27760,CVE-2020-27761,CVE-2020-27762,CVE-2020-27763,CVE-2020-27764,
  CVE-2020-27765,CVE-2020-27766,CVE-2020-27767,CVE-2020-27768,CVE-2020-27769,
  CVE-2020-27770,CVE-2020-27771,CVE-2020-27772,CVE-2020-27773,CVE-2020-27774,
  CVE-2020-27775,CVE-2020-27776,CVE-2020-29599,CVE-2021-20241,CVE-2021-20311,
  CVE-2021-20312,CVE-2021-20313,CVE-2021-20241,CVE-2021-20243,CVE-2021-20244,
  CVE-2021-20246
  (bsc#1094741,bsc#1094742,bsc#1094745,bsc#1095812,bsc#1096200,bsc#1096203,
  bsc#1098545,bsc#1098546,bsc#1102003,bsc#1102004,bsc#1102005,bsc#1102007,
  bsc#1106254,bsc#1106855,bsc#1106857,bsc#1106858,bsc#1106989,bsc#1106996,
  bsc#1107604,bsc#1107609,bsc#1107612,bsc#1107616,bsc#1107618,bsc#1107619,
  bsc#1110746,bsc#1111069,bsc#1111072,bsc#1113064,bsc#1120381,bsc#1124365,
  bsc#1124366,bsc#1124367,bsc#1124368,bsc#1128649,bsc#1130330,bsc#1131317,
  bsc#1132054,bsc#1132060,bsc#1133204,bsc#1133205,bsc#1133498,bsc#1133501,
  bsc#1136732,bsc#1138464,bsc#1139884,bsc#1139885,bsc#1139886,bsc#1140100,
  bsc#1140102,bsc#1140103,bsc#1140104,bsc#1140105,bsc#1140106,bsc#1140110,
  bsc#1140111,bsc#1140501,bsc#1140513,bsc#1140520,bsc#1140534,bsc#1140538,
  bsc#1140543,bsc#1140545,bsc#1140547,bsc#1140549,bsc#1140552,bsc#1140554,
  bsc#1140664,bsc#1140665,bsc#1140666,bsc#1140667,bsc#1140668,bsc#1140669,
  bsc#1140673,bsc#1141171,bsc#1146065,bsc#1146068,bsc#1146211,bsc#1146212,
  bsc#1146213,bsc#1151781,bsc#1151782,bsc#1151783,bsc#1151784,bsc#1151785,
  bsc#1151786,bsc#1159861,bsc#1160369,bsc#1161194,bsc#1178067,bsc#1179103,
  bsc#1179202,bsc#1179208,bsc#1179212,bsc#1179221,bsc#1179223,bsc#1179240,
  bsc#1179244,bsc#1179260,bsc#1179268,bsc#1179269,bsc#1179276,bsc#1179278,
  bsc#1179281,bsc#1179285,bsc#1179311,bsc#1179312,bsc#1179313,bsc#1179315,
  bsc#1179317,bsc#1179321,bsc#1179322,bsc#1179327,bsc#1179333,bsc#1179336,
  bsc#1179338,bsc#1179339,bsc#1179343,bsc#1179345,bsc#1179346,bsc#1179347,
  bsc#1179361,bsc#1179362,bsc#1179397,bsc#1179753,bsc#1182335,bsc#1184624,
  bsc#1184626,bsc#1184627,bsc#1184628,bsc#1182335,bsc#1182336,bsc#1182325,
  bsc#1182337)</changelog>
  <changelog author="pgajdos@suse.com" date="1644235200">- fix https://github.com/ImageMagick/ImageMagick/issues/4790 [bsc#1195321]
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/b51707c08f3dee192d464d38fc507c86051e62e6
  + ImageMagick-gradient-black-white.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1644321600">- security update
- added patches
  fix CVE-2022-0284 [bsc#1195563], Heap buffer overread in GetPixelAlpha()
  in MagickCore/pixel-accessor.h
  + ImageMagick-CVE-2022-0284.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1645704000">- security update
- added patches
  fix CVE-2021-4219 [bsc#1196337], denial of service in MagicCore/draw.c via crafted SVG file
  + ImageMagick-CVE-2021-4219.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1650628800">- security update
- added patches
  fix CVE-2022-1114 [bsc#1198700], heap-use-after-free in RelinquishDCMInfo of dcm.c
  + ImageMagick-CVE-2022-1114.patch
  fix CVE-2022-1115 [bsc#1198701], heap-buffer-overflow in PushShortPixel of quantum-private.h
  + ImageMagick-CVE-2022-1115.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655121600">- security update
- added patches
  fix CVE-2022-32545 [bsc#1200388], outside the range of representable values of type 'unsigned char' at coders/psd.c
  + ImageMagick-CVE-2022-32545.patch
  fix CVE-2022-32546 [bsc#1200389], outside the range of representable values of type 'unsigned long' at coders/pcl.c
  + ImageMagick-CVE-2022-32546.patch
  fix CVE-2022-32547 [bsc#1200387], load of misaligned address at MagickCore/property.c
  + ImageMagick-CVE-2022-32547.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1660910400">- security update
- added patches
  fix CVE-2022-28463 [bsc#1199350], ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
  + ImageMagick-CVE-2022-28463.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661169600">- security update
- added patches
  fix CVE-2022-2719 [bsc#1202250], DoS due to attempted writing of NULL image list
  + ImageMagick-CVE-2022-2719.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1663588800">- security update
- added patches
  fix CVE-2022-3213 [bsc#1203450], heap buffer overflow while processing a malformed TIFF file
  + ImageMagick-CVE-2022-3213.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1675944000">- security update
- added patches
  fix CVE-2022-44267 [bsc#1207982], denial of service when parsing a PNG image
  fix CVE-2022-44268 [bsc#1207983], arbitrary file disclosure when parsing a PNG image
  + ImageMagick-CVE-2022-44267,44268.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678968000">- security update
- added patches
  fix CVE-2023-1289 [bsc#1209141], segmentation fault and possible DoS via specially crafted SVG
  + ImageMagick-CVE-2023-1289.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1681473600">- security update
- added patches
  fix CVE-2023-1906 [bsc#1210308], heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
  + ImageMagick-CVE-2023-1906.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- security update
- added patches
  fix CVE-2023-34151 [bsc#1211791], Undefined behaviors of casting double to size_t in svg, mvg and other coders
  + ImageMagick-CVE-2023-34151.patch
  fix CVE-2023-34153 [bsc#1211792], Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding
  + ImageMagick-CVE-2023-34153.patch</changelog>
</package>
<package pkgid="ff27713e0dab4e3d7fbbda08e132dcbb88cb84d55cc46db216962ff5d077e4fd" name="perl-SNMP" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="352d19c67098c503d065754d59d6e0933760d720619b9c00639099cb49a035fe" name="perl-SNMP" arch="ppc64le">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="cc66f743963a004163799066ff8f763a35070fbb0920e94a23c93aaff3d70f9e" name="perl-SNMP" arch="s390x">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="200397349135f29a1535f5dce57e95a139dc4f3593d821f2939ab0edbead389a" name="perl-SNMP" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="709718262053653ae0aecab7aa52c2303bb48810c16146ae3d969b8548e802f4" name="perl-solv" arch="aarch64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="e593aefcb5921e93c4ec5deb1294c6ad93fafdd0361ca8b78871d487de800fd9" name="perl-solv" arch="ppc64le">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="2186a22c1efa031ff0b24a07758720f7a5322df104aa3bf593300e1c72cbe5a1" name="perl-solv" arch="s390x">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="c47395e969ce3e7a64f43bf3bad320b5a45623732faab7d7511623bbe8a95748" name="perl-solv" arch="x86_64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="f359e32af604176f90f2d27278f8f6f22c9e1aa5f39c0e4acd0125ee47066be4" name="picocli" arch="noarch">
  <version epoch="0" ver="4.6.2" rel="150200.3.8.1"/>
  <changelog author="fstrba@suse.com" date="1573214400">- Initial packaging of picocli 4.0.4</changelog>
  <changelog author="fstrba@suse.com" date="1642507200">- Upgrade to version 4.6.2
  * full changes from previous versions are in
    https://github.com/remkop/picocli/blob/v4.6.2/RELEASE-NOTES.md</changelog>
  <changelog author="fstrba@suse.com" date="1656072000">- Build picocli using ant to avoid cycles</changelog>
</package>
<package pkgid="a9a2aa6915205fed60acf9f41b6db0c176a47a0bbcb583832f71ffc46a3dfc3d" name="picocli" arch="src">
  <version epoch="0" ver="4.6.2" rel="150200.3.8.1"/>
  <changelog author="fstrba@suse.com" date="1573214400">- Initial packaging of picocli 4.0.4</changelog>
  <changelog author="fstrba@suse.com" date="1642507200">- Upgrade to version 4.6.2
  * full changes from previous versions are in
    https://github.com/remkop/picocli/blob/v4.6.2/RELEASE-NOTES.md</changelog>
  <changelog author="fstrba@suse.com" date="1656072000">- Build picocli using ant to avoid cycles</changelog>
</package>
<package pkgid="81048d107dd25e335f03e1e93b782543fdb0457bb1d63070150cff1324735e19" name="picocli-javadoc" arch="noarch">
  <version epoch="0" ver="4.6.2" rel="150200.3.8.1"/>
  <changelog author="fstrba@suse.com" date="1573214400">- Initial packaging of picocli 4.0.4</changelog>
  <changelog author="fstrba@suse.com" date="1642507200">- Upgrade to version 4.6.2
  * full changes from previous versions are in
    https://github.com/remkop/picocli/blob/v4.6.2/RELEASE-NOTES.md</changelog>
  <changelog author="fstrba@suse.com" date="1656072000">- Build picocli using ant to avoid cycles</changelog>
</package>
<package pkgid="29f9d7368c691f8b1ea048c5cf72e2e4753fd169ea097c6850fe44dae220b28d" name="post-build-checks" arch="noarch">
  <version epoch="0" ver="84.87+git20220325.f46ef3c" rel="150500.3.2.1"/>
  <changelog author="mliska@suse.cz" date="1562932800">- Disable tests as GCC checks are gone.</changelog>
  <changelog author="ro@suse.com" date="1563278400">- Update to version 84.88+git20190716.5a0e034:
  * Remove unused tests.</changelog>
  <changelog author="ro@suse.com" date="1578398400">- Update to version 84.88+git20200107.dc3b3a3:
  * 99-check-remove-rpms: preserve libgomp variants</changelog>
  <changelog author="lnussel@suse.de" date="1578657600">- Update to version 84.87+git20200110.2d02f07:
  * Tweaks to make rpm-ndb build
  * Detect name of coreutils package and don't remove it
- restore correct version</changelog>
  <changelog author="lnussel@suse.de" date="1583409600">- Update to version 84.87+git20200305.61b5cdf:
  * Fix ghost logic</changelog>
  <changelog author="lnussel@suse.de" date="1584619200">- Update to version 84.87+git20200319.57fe0e2:
  * Don't de-install the packages containing su and sh</changelog>
  <changelog author="kukuk@suse.com" date="1584964800">- Update to version 84.87+git20200323.45c6eba:
  * Don't remove find, gzip and cpio</changelog>
  <changelog author="ro@suse.de" date="1597752000">- Update to version 84.87+git20200818.e4ffaa8:
  * 50-check-permissions use --level option of chkstat
    (boo#1159963)</changelog>
  <changelog author="ro@suse.de" date="1597838400">- Update to version 84.87+git20200819.5847424:
  * Revert "50-check-permissions use --level option of chkstat"</changelog>
  <changelog author="ro@suse.de" date="1598270400">- add the abuild user to the trusted group so that
  fusermount works (boo#1159963)</changelog>
  <changelog author="ro@suse.de" date="1600257600">- Update to version 84.87+git20200916.d341ab0:
  * add finalize-system hacks
  * 01-add_abuild_user_to_trusted_group
  * also create abuild user if needed
  * 02-set_timezone_to_utc
  * 11-hack_uname_version_to_kernel_version
  * 98-revert-uname-hack
  * add cleanup as check script
- drop all pre/post scripts this is now all done by hooks
  inside the buildsystem, the package install scripts will
  not do any harm now and we do not depend on the install
  sequence any more (revisited boo#1159963)</changelog>
  <changelog author="lnussel@suse.de" date="1612785600">- Update to version 84.87+git20210208.d8d4154:
  * Don't remove usrmerge helper packages (boo#1029961)</changelog>
  <changelog author="ro@suse.de" date="1613390400">- Update to version 84.87+git20210215.ed75983:
  * Don't deinstall any pam_unix variant</changelog>
  <changelog author="lnussel@suse.de" date="1614859200">- Update to version 84.87+git20210304.df696a0:
  * final name is glibc-usrmerge-bootstrap-helper</changelog>
  <changelog author="ro@suse.de" date="1621252800">- Update to version 84.87+git20210517.d960568:
  * support cross builds</changelog>
  <changelog author="ro@suse.de" date="1643371200">- Update to version 84.87+git20220128.2a04ecb:
  * keep package that provides /usr/bin/sh</changelog>
  <changelog author="ro@suse.de" date="1643371201">- Update to version 84.87+git20220128.77a97b9:
  * change cross build detection logic to be more robust
  * kill useless use of cat awards</changelog>
  <changelog author="lnussel@suse.de" date="1647864000">- Update to version 84.87+git20220321.9651edb:
  * Restore secure permissions in build environment (bsc#1159963)
  * Handle default being easy
  * Various speedups around invoking rpm
- change service file from disabled to manual</changelog>
  <changelog author="dmueller@suse.com" date="1647950400">- Update to version 84.87+git20220322.48f07a0:
  * Remove errneous whitespaces
  * fix comparison name</changelog>
  <changelog author="meissner@suse.com" date="1648468800">- Update to version 84.87+git20220325.f46ef3c:
  * enable -z now linking by default</changelog>
</package>
<package pkgid="feeb59ccefe8d4723def957ecd55a748d977516e977f8009d6717d79336ac9a2" name="post-build-checks" arch="src">
  <version epoch="0" ver="84.87+git20220325.f46ef3c" rel="150500.3.2.1"/>
  <changelog author="mliska@suse.cz" date="1562932800">- Disable tests as GCC checks are gone.</changelog>
  <changelog author="ro@suse.com" date="1563278400">- Update to version 84.88+git20190716.5a0e034:
  * Remove unused tests.</changelog>
  <changelog author="ro@suse.com" date="1578398400">- Update to version 84.88+git20200107.dc3b3a3:
  * 99-check-remove-rpms: preserve libgomp variants</changelog>
  <changelog author="lnussel@suse.de" date="1578657600">- Update to version 84.87+git20200110.2d02f07:
  * Tweaks to make rpm-ndb build
  * Detect name of coreutils package and don't remove it
- restore correct version</changelog>
  <changelog author="lnussel@suse.de" date="1583409600">- Update to version 84.87+git20200305.61b5cdf:
  * Fix ghost logic</changelog>
  <changelog author="lnussel@suse.de" date="1584619200">- Update to version 84.87+git20200319.57fe0e2:
  * Don't de-install the packages containing su and sh</changelog>
  <changelog author="kukuk@suse.com" date="1584964800">- Update to version 84.87+git20200323.45c6eba:
  * Don't remove find, gzip and cpio</changelog>
  <changelog author="ro@suse.de" date="1597752000">- Update to version 84.87+git20200818.e4ffaa8:
  * 50-check-permissions use --level option of chkstat
    (boo#1159963)</changelog>
  <changelog author="ro@suse.de" date="1597838400">- Update to version 84.87+git20200819.5847424:
  * Revert "50-check-permissions use --level option of chkstat"</changelog>
  <changelog author="ro@suse.de" date="1598270400">- add the abuild user to the trusted group so that
  fusermount works (boo#1159963)</changelog>
  <changelog author="ro@suse.de" date="1600257600">- Update to version 84.87+git20200916.d341ab0:
  * add finalize-system hacks
  * 01-add_abuild_user_to_trusted_group
  * also create abuild user if needed
  * 02-set_timezone_to_utc
  * 11-hack_uname_version_to_kernel_version
  * 98-revert-uname-hack
  * add cleanup as check script
- drop all pre/post scripts this is now all done by hooks
  inside the buildsystem, the package install scripts will
  not do any harm now and we do not depend on the install
  sequence any more (revisited boo#1159963)</changelog>
  <changelog author="lnussel@suse.de" date="1612785600">- Update to version 84.87+git20210208.d8d4154:
  * Don't remove usrmerge helper packages (boo#1029961)</changelog>
  <changelog author="ro@suse.de" date="1613390400">- Update to version 84.87+git20210215.ed75983:
  * Don't deinstall any pam_unix variant</changelog>
  <changelog author="lnussel@suse.de" date="1614859200">- Update to version 84.87+git20210304.df696a0:
  * final name is glibc-usrmerge-bootstrap-helper</changelog>
  <changelog author="ro@suse.de" date="1621252800">- Update to version 84.87+git20210517.d960568:
  * support cross builds</changelog>
  <changelog author="ro@suse.de" date="1643371200">- Update to version 84.87+git20220128.2a04ecb:
  * keep package that provides /usr/bin/sh</changelog>
  <changelog author="ro@suse.de" date="1643371201">- Update to version 84.87+git20220128.77a97b9:
  * change cross build detection logic to be more robust
  * kill useless use of cat awards</changelog>
  <changelog author="lnussel@suse.de" date="1647864000">- Update to version 84.87+git20220321.9651edb:
  * Restore secure permissions in build environment (bsc#1159963)
  * Handle default being easy
  * Various speedups around invoking rpm
- change service file from disabled to manual</changelog>
  <changelog author="dmueller@suse.com" date="1647950400">- Update to version 84.87+git20220322.48f07a0:
  * Remove errneous whitespaces
  * fix comparison name</changelog>
  <changelog author="meissner@suse.com" date="1648468800">- Update to version 84.87+git20220325.f46ef3c:
  * enable -z now linking by default</changelog>
</package>
<package pkgid="c0455058a955b86ab7caa009683a916764943b9a026bbf64ef837bc47737862a" name="powerpc-utils" arch="ppc64le">
  <version epoch="0" ver="1.3.11" rel="150500.3.3.1"/>
  <changelog author="msuchanek@suse.de" date="1635508800">- Avoid error with HCN IDs containing same consecutive bytes (bsc#1192095 ltc#194963).
  + hcnmgr-Avoid-hexdum-squeezing-consecutive-identical-.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1641384000">- Add support for vnic backup device for HNV (jsc#SLE-23097).
  + 0001-hcnmgr-Support-vNIC-as-backup-device.patch
  + 0002-hcnmgr-Remove-some-dead-code.patch
- Add support for NVMf devices (jsc#SLE-18643, bsc#1198728, ltc#197650).
  + 0003-ofpathname-Fix-nvme-support-in-ANA-mode.patch
  + 0004-ofpathname-Add-support-for-NVMf-devices.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1641384001">- Fix reported online memory in legacy format (bsc#1191147).
  + lparstat-Fix-reported-online-memory-in-legacy-format.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1641988800">- errinjct: sanitize devspec output of a newline if one is present (bsc#1194579 ltc#195746).
  + errinjct-sanitize-devspec-output-of-a-newline-if-one.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1643284800">- Add HNV wicked support (bsc#1193543 jsc#SLE-18127).
  + 0001-Validate-connection-manager.patch
  + 0002-factor-out-NetworkManager-nmcli-code.patch
  + 0003-Add-new-wicked-functions-from-suse-to-manage-bonding.patch
  + 0004-Support-wicked-HNV-using-new-wicked-interfaces-for.patch
  + 0005-Set-modprobe-bonding-max_bonds-0-option.patch
  + 0006-cleanup-hcnmgr-distro-and-service-detection.patch
  + 0007-Remove-wicked-ifup-calls-that-just-run-into-timeouts.patch
  + 0008-add-note-about-comma-in-hcnmgr-BONDOPTIONS.patch
  + 0009-Fix-to-call-wicked-ifreload-directly.patch
  + 0010-Fix-incorrect-parameters-to-suse_ifcfg_bond_create.patch
  + 0011-Fix-comment-about-setting-primary.patch
  + 0012-Description-and-indenting-corrections.patch
  + 0013-adjust-sourcing-path-of-the-functions.suse-library.patch
  + 0014-Enable-the-network-service-checks.patch
  + 0015-add-hcn-init.service.suse-service-covering-wicked.patch
- Install SUSE-specific scripts</changelog>
  <changelog author="msuchanek@suse.com" date="1643803200">- Install smt.state as config file (bsc#1195413 ltc#193325).</changelog>
  <changelog author="msuchanek@suse.com" date="1644235200">- Fix HNV migration and other HNV issues (bsc#1195404 ltc#196259).
  + 0016-functions.suse-fix-suse-wlist-utility-functions.patch
  + 0017-functions.suse-don-t-implicitly-set-primary-to-1st-s.patch
  + 0018-hcnmgr-add-x-option-to-trace-hcnmgr-script-execution.patch
  + 0019-check-platform-service-after-getopts-parsing.patch
  + 0020-call-less-intrusive-ifdown-ifup-in-rmdev_wicked.patch
  + 0021-call-ifup-instead-ifreload-in-config_vdevice_wicked.patch
  + 0022-split-scanhcn-function-into-nm-wicked-variants.patch
  + 0023-hcnmgr-merged-scanhcn_wicked-id-fix-and-comments.patch
  + 0024-Fix-race-with-udev-renaming-and-hcn-configure.patch
  + 0025-hcnmgr-remove-ifcfg-file-dump-from-scanhcn_wicked.patch
  + 0026-hcnmgr-move-sourcing-functions.suse-to-wicked-case.patch
  + 0027-hcnmgr-extend-suse-os-release-match.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645099200">- Update HNV implementation (bsc#1195404 ltc#196259 jsc#SLE-23855).
  + 0001-Validate-connection-manager-and-add-option-to-trace-.patch
  + 0002-Factor-out-NetworkManager-nmcli-code.patch
  * 0003-Add-new-wicked-functions-from-suse-to-manage-bonding.patch
  + 0004-Support-wicked-HNV-using-new-wicked-functions-for-bo.patch
  + 0005-hcnmgr-maintain-hcnid-state-for-later-cleanup.patch
  + 0006-Add-hcn-init.service.suse.patch
  - 0001-Validate-connection-manager.patch
  - 0002-factor-out-NetworkManager-nmcli-code.patch
  - 0004-Support-wicked-HNV-using-new-wicked-interfaces-for.patch
  - 0005-Set-modprobe-bonding-max_bonds-0-option.patch
  - 0006-cleanup-hcnmgr-distro-and-service-detection.patch
  - 0007-Remove-wicked-ifup-calls-that-just-run-into-timeouts.patch
  - 0008-add-note-about-comma-in-hcnmgr-BONDOPTIONS.patch
  - 0009-Fix-to-call-wicked-ifreload-directly.patch
  - 0010-Fix-incorrect-parameters-to-suse_ifcfg_bond_create.patch
  - 0011-Fix-comment-about-setting-primary.patch
  - 0012-Description-and-indenting-corrections.patch
  - 0013-adjust-sourcing-path-of-the-functions.suse-library.patch
  - 0014-Enable-the-network-service-checks.patch
  - 0015-add-hcn-init.service.suse-service-covering-wicked.patch
  - 0016-functions.suse-fix-suse-wlist-utility-functions.patch
  - 0017-functions.suse-don-t-implicitly-set-primary-to-1st-s.patch
  - 0018-hcnmgr-add-x-option-to-trace-hcnmgr-script-execution.patch
  - 0019-check-platform-service-after-getopts-parsing.patch
  - 0020-call-less-intrusive-ifdown-ifup-in-rmdev_wicked.patch
  - 0021-call-ifup-instead-ifreload-in-config_vdevice_wicked.patch
  - 0022-split-scanhcn-function-into-nm-wicked-variants.patch
  - 0023-hcnmgr-merged-scanhcn_wicked-id-fix-and-comments.patch
  - 0024-Fix-race-with-udev-renaming-and-hcn-configure.patch
  - 0025-hcnmgr-remove-ifcfg-file-dump-from-scanhcn_wicked.patch
  - 0026-hcnmgr-move-sourcing-functions.suse-to-wicked-case.patch
  - 0027-hcnmgr-extend-suse-os-release-match.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645099201">- lparstat: report LPAR name from lparcfg (bsc#1187716 ltc#193451).
  + lparstat-report-LPAR-name-from-lparcfg.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645790400">- Fix setting HNV primary slave with NM (bsc#1195404 ltc#196259).
  - 0007-Fix-NM-HNV-setting-primary-slave.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645790401">- Fix lsslot showing "Unknown slot type" for recent PCIe slot types (bsc#1196411 ltc#196505).
  - lsslot-Add-new-DRC-type-description-strings.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1655294400">- Update to upstream version 1.3.10
  * ppc64_cpu: Add support to parse PAPR information for energy and frequency (bsc#1200465 ltc#197256 jsc#SLE-18129 jsc#PED-519)
  * powerpc-utils: Enhance error message when lparstat -E fails on max config systems (bsc#1198956 ltc#196850)
  * drmgr: Add support for 'acc' command (jsc#SLE-18644)
  * hcn-init.service: Add RemainAfterExit=yes
  * man/drmgr: fix multiple typos
  * hcnmgr: Add new feature "wicked" in HNV FEATURE list
  * hcnmgr: Update Makefile and powerpc-utils spec file to support HNV and wicked
  * hcnmgr: Fix NM HNV setting primary slave
  * hcnmgr: Add hcn-init.service.suse
  * hcnmgr: maintain hcnid state for later cleanup
  * hcnmgr: Support wicked HNV using new wicked functions for bonding
  * hcnmgr: Add new wicked functions for SuSE to manage bonding
  * hcnmgr: Factor out NetworkManager nmcli code
  * hcnmgr: Validate connection manager and add tracing option
  * bootlist: fix invalid hex number message
  * bootlist: fix passing -l flag to kpartx as -p delimiter value
  * lsslot: fix memory leak when listing IO slots
  * lsslot: Add new DRC type description strings for latest PCIe slot types
  * lparstat: report LPAR name from lparcfg
  * errinjct: sanitize devspec output of a newline if one is present
  * lparstat: Fix reported online memory in legacy format
  * ofpathname: Add support for NVMf devices
  * ofpathname: Fix nvme support in ANA mode
  * hcnmgr: Support vNIC as backup device
  * hcnmgr: Avoid hexdump squeezing consecutive identical bytes.
  * lsdevinfo: optimize criteria filtering
  * Remove upstreamed patches
  - lsdevinfo-optimize-criteria-filtering.patch
  - hcnmgr-Avoid-hexdum-squeezing-consecutive-identical-.patch
  - 0001-hcnmgr-Support-vNIC-as-backup-device.patch
  - 0002-hcnmgr-Remove-some-dead-code.patch
  - 0003-ofpathname-Fix-nvme-support-in-ANA-mode.patch
  - 0004-ofpathname-Add-support-for-NVMf-devices.patch
  - lparstat-Fix-reported-online-memory-in-legacy-format.patch
  - errinjct-sanitize-devspec-output-of-a-newline-if-one.patch
  - lparstat-report-LPAR-name-from-lparcfg.patch
  - lsslot-Add-new-DRC-type-description-strings.patch
  - 0001-Validate-connection-manager-and-add-option-to-trace-.patch
  - 0002-Factor-out-NetworkManager-nmcli-code.patch
  - 0003-Add-new-wicked-functions-from-suse-to-manage-bonding.patch
  - 0004-Support-wicked-HNV-using-new-wicked-functions-for-bo.patch
  - 0005-hcnmgr-maintain-hcnid-state-for-later-cleanup.patch
  - 0006-Add-hcn-init.service.suse.patch
  - 0007-Fix-NM-HNV-setting-primary-slave.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1664884800">- Fix "lsslot -c mem" output when LMB size is set to 4GB (bsc#1202777 ltc#199300)
  + lsslot-Fix-lsslot-c-mem-output-when-using-4GB-LMB-si.patch
  + lsslot-Explicity-declare-that-lmb_address-be-display.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1668427200">- NVMf boot support (bsc#1205351 ltc#200481)
  + bootlist-Add-install-boot-support-for-nvmf-devices.patch
  + ofpathname-Fix-several-issues-in-nvmf-boot-install-s.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1669291200">- nsid of nvmf device needs to be lowercase (bsc#1205697 ltc#200594)
  + ofpathname-Handle-nsid-as-hex-in-nvmf-boot-install-s.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1669809600">- Support multiple dev paths for a nvmf boot device (bsc#1205696 ltc#200595)
  + Support-multiple-dev-paths-for-a-nvmf-boot-device.patch</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="msuchanek@suse.com" date="1672660800">- Fix lparstat cpu mode display in a dedicated-donating LPAR (bsc#1206518 ltc#200949)
  + lparstat-Fix-display-of-mode-for-dedicated-donating-.patch
- Fix cpu utilization display
  + lparstat-Fix-array-overflow-issue.patch
- Fix setting primaty HNV link when using NM
  + hcnmgr-Fix-setting-primary-slave-across-reboots.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1674648000">- Update to version 1.3.11 (jsc#PED-560)
  - Add support for drmgr hooks.
- Drop upstreamed patches
  - Support-multiple-dev-paths-for-a-nvmf-boot-device.patch
  - bootlist-Add-install-boot-support-for-nvmf-devices.patch
  - hcnmgr-Fix-setting-primary-slave-across-reboots.patch
  - lparstat-Fix-array-overflow-issue.patch
  - lparstat-Fix-display-of-mode-for-dedicated-donating-.patch
  - lsslot-Explicity-declare-that-lmb_address-be-display.patch
  - lsslot-Fix-lsslot-c-mem-output-when-using-4GB-LMB-si.patch
  - ofpathname-Fix-several-issues-in-nvmf-boot-install-s.patch
  - ofpathname-Handle-nsid-as-hex-in-nvmf-boot-install-s.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1685966400">- Fix negative utilization value reported by lparstat -E (bsc#1212031)
  + lparstat-Fix-negative-values-seen-while-running-lpar.patch
- Fix lparstat error with mixed SMT state (bsc#1211883 ltc#02144)
  + lparstat-report-mixed-SMT-state.patch
  + lparstat-Fix-offline-threads-uninitialized-entries.patch</changelog>
</package>
<package pkgid="ca890b04277571182c46109b25333a025519e60cec3d0095716f7a29179b0ce9" name="powerpc-utils" arch="src">
  <version epoch="0" ver="1.3.11" rel="150500.3.3.1"/>
  <changelog author="msuchanek@suse.de" date="1635508800">- Avoid error with HCN IDs containing same consecutive bytes (bsc#1192095 ltc#194963).
  + hcnmgr-Avoid-hexdum-squeezing-consecutive-identical-.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1641384000">- Add support for vnic backup device for HNV (jsc#SLE-23097).
  + 0001-hcnmgr-Support-vNIC-as-backup-device.patch
  + 0002-hcnmgr-Remove-some-dead-code.patch
- Add support for NVMf devices (jsc#SLE-18643, bsc#1198728, ltc#197650).
  + 0003-ofpathname-Fix-nvme-support-in-ANA-mode.patch
  + 0004-ofpathname-Add-support-for-NVMf-devices.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1641384001">- Fix reported online memory in legacy format (bsc#1191147).
  + lparstat-Fix-reported-online-memory-in-legacy-format.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1641988800">- errinjct: sanitize devspec output of a newline if one is present (bsc#1194579 ltc#195746).
  + errinjct-sanitize-devspec-output-of-a-newline-if-one.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1643284800">- Add HNV wicked support (bsc#1193543 jsc#SLE-18127).
  + 0001-Validate-connection-manager.patch
  + 0002-factor-out-NetworkManager-nmcli-code.patch
  + 0003-Add-new-wicked-functions-from-suse-to-manage-bonding.patch
  + 0004-Support-wicked-HNV-using-new-wicked-interfaces-for.patch
  + 0005-Set-modprobe-bonding-max_bonds-0-option.patch
  + 0006-cleanup-hcnmgr-distro-and-service-detection.patch
  + 0007-Remove-wicked-ifup-calls-that-just-run-into-timeouts.patch
  + 0008-add-note-about-comma-in-hcnmgr-BONDOPTIONS.patch
  + 0009-Fix-to-call-wicked-ifreload-directly.patch
  + 0010-Fix-incorrect-parameters-to-suse_ifcfg_bond_create.patch
  + 0011-Fix-comment-about-setting-primary.patch
  + 0012-Description-and-indenting-corrections.patch
  + 0013-adjust-sourcing-path-of-the-functions.suse-library.patch
  + 0014-Enable-the-network-service-checks.patch
  + 0015-add-hcn-init.service.suse-service-covering-wicked.patch
- Install SUSE-specific scripts</changelog>
  <changelog author="msuchanek@suse.com" date="1643803200">- Install smt.state as config file (bsc#1195413 ltc#193325).</changelog>
  <changelog author="msuchanek@suse.com" date="1644235200">- Fix HNV migration and other HNV issues (bsc#1195404 ltc#196259).
  + 0016-functions.suse-fix-suse-wlist-utility-functions.patch
  + 0017-functions.suse-don-t-implicitly-set-primary-to-1st-s.patch
  + 0018-hcnmgr-add-x-option-to-trace-hcnmgr-script-execution.patch
  + 0019-check-platform-service-after-getopts-parsing.patch
  + 0020-call-less-intrusive-ifdown-ifup-in-rmdev_wicked.patch
  + 0021-call-ifup-instead-ifreload-in-config_vdevice_wicked.patch
  + 0022-split-scanhcn-function-into-nm-wicked-variants.patch
  + 0023-hcnmgr-merged-scanhcn_wicked-id-fix-and-comments.patch
  + 0024-Fix-race-with-udev-renaming-and-hcn-configure.patch
  + 0025-hcnmgr-remove-ifcfg-file-dump-from-scanhcn_wicked.patch
  + 0026-hcnmgr-move-sourcing-functions.suse-to-wicked-case.patch
  + 0027-hcnmgr-extend-suse-os-release-match.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645099200">- Update HNV implementation (bsc#1195404 ltc#196259 jsc#SLE-23855).
  + 0001-Validate-connection-manager-and-add-option-to-trace-.patch
  + 0002-Factor-out-NetworkManager-nmcli-code.patch
  * 0003-Add-new-wicked-functions-from-suse-to-manage-bonding.patch
  + 0004-Support-wicked-HNV-using-new-wicked-functions-for-bo.patch
  + 0005-hcnmgr-maintain-hcnid-state-for-later-cleanup.patch
  + 0006-Add-hcn-init.service.suse.patch
  - 0001-Validate-connection-manager.patch
  - 0002-factor-out-NetworkManager-nmcli-code.patch
  - 0004-Support-wicked-HNV-using-new-wicked-interfaces-for.patch
  - 0005-Set-modprobe-bonding-max_bonds-0-option.patch
  - 0006-cleanup-hcnmgr-distro-and-service-detection.patch
  - 0007-Remove-wicked-ifup-calls-that-just-run-into-timeouts.patch
  - 0008-add-note-about-comma-in-hcnmgr-BONDOPTIONS.patch
  - 0009-Fix-to-call-wicked-ifreload-directly.patch
  - 0010-Fix-incorrect-parameters-to-suse_ifcfg_bond_create.patch
  - 0011-Fix-comment-about-setting-primary.patch
  - 0012-Description-and-indenting-corrections.patch
  - 0013-adjust-sourcing-path-of-the-functions.suse-library.patch
  - 0014-Enable-the-network-service-checks.patch
  - 0015-add-hcn-init.service.suse-service-covering-wicked.patch
  - 0016-functions.suse-fix-suse-wlist-utility-functions.patch
  - 0017-functions.suse-don-t-implicitly-set-primary-to-1st-s.patch
  - 0018-hcnmgr-add-x-option-to-trace-hcnmgr-script-execution.patch
  - 0019-check-platform-service-after-getopts-parsing.patch
  - 0020-call-less-intrusive-ifdown-ifup-in-rmdev_wicked.patch
  - 0021-call-ifup-instead-ifreload-in-config_vdevice_wicked.patch
  - 0022-split-scanhcn-function-into-nm-wicked-variants.patch
  - 0023-hcnmgr-merged-scanhcn_wicked-id-fix-and-comments.patch
  - 0024-Fix-race-with-udev-renaming-and-hcn-configure.patch
  - 0025-hcnmgr-remove-ifcfg-file-dump-from-scanhcn_wicked.patch
  - 0026-hcnmgr-move-sourcing-functions.suse-to-wicked-case.patch
  - 0027-hcnmgr-extend-suse-os-release-match.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645099201">- lparstat: report LPAR name from lparcfg (bsc#1187716 ltc#193451).
  + lparstat-report-LPAR-name-from-lparcfg.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645790400">- Fix setting HNV primary slave with NM (bsc#1195404 ltc#196259).
  - 0007-Fix-NM-HNV-setting-primary-slave.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1645790401">- Fix lsslot showing "Unknown slot type" for recent PCIe slot types (bsc#1196411 ltc#196505).
  - lsslot-Add-new-DRC-type-description-strings.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1655294400">- Update to upstream version 1.3.10
  * ppc64_cpu: Add support to parse PAPR information for energy and frequency (bsc#1200465 ltc#197256 jsc#SLE-18129 jsc#PED-519)
  * powerpc-utils: Enhance error message when lparstat -E fails on max config systems (bsc#1198956 ltc#196850)
  * drmgr: Add support for 'acc' command (jsc#SLE-18644)
  * hcn-init.service: Add RemainAfterExit=yes
  * man/drmgr: fix multiple typos
  * hcnmgr: Add new feature "wicked" in HNV FEATURE list
  * hcnmgr: Update Makefile and powerpc-utils spec file to support HNV and wicked
  * hcnmgr: Fix NM HNV setting primary slave
  * hcnmgr: Add hcn-init.service.suse
  * hcnmgr: maintain hcnid state for later cleanup
  * hcnmgr: Support wicked HNV using new wicked functions for bonding
  * hcnmgr: Add new wicked functions for SuSE to manage bonding
  * hcnmgr: Factor out NetworkManager nmcli code
  * hcnmgr: Validate connection manager and add tracing option
  * bootlist: fix invalid hex number message
  * bootlist: fix passing -l flag to kpartx as -p delimiter value
  * lsslot: fix memory leak when listing IO slots
  * lsslot: Add new DRC type description strings for latest PCIe slot types
  * lparstat: report LPAR name from lparcfg
  * errinjct: sanitize devspec output of a newline if one is present
  * lparstat: Fix reported online memory in legacy format
  * ofpathname: Add support for NVMf devices
  * ofpathname: Fix nvme support in ANA mode
  * hcnmgr: Support vNIC as backup device
  * hcnmgr: Avoid hexdump squeezing consecutive identical bytes.
  * lsdevinfo: optimize criteria filtering
  * Remove upstreamed patches
  - lsdevinfo-optimize-criteria-filtering.patch
  - hcnmgr-Avoid-hexdum-squeezing-consecutive-identical-.patch
  - 0001-hcnmgr-Support-vNIC-as-backup-device.patch
  - 0002-hcnmgr-Remove-some-dead-code.patch
  - 0003-ofpathname-Fix-nvme-support-in-ANA-mode.patch
  - 0004-ofpathname-Add-support-for-NVMf-devices.patch
  - lparstat-Fix-reported-online-memory-in-legacy-format.patch
  - errinjct-sanitize-devspec-output-of-a-newline-if-one.patch
  - lparstat-report-LPAR-name-from-lparcfg.patch
  - lsslot-Add-new-DRC-type-description-strings.patch
  - 0001-Validate-connection-manager-and-add-option-to-trace-.patch
  - 0002-Factor-out-NetworkManager-nmcli-code.patch
  - 0003-Add-new-wicked-functions-from-suse-to-manage-bonding.patch
  - 0004-Support-wicked-HNV-using-new-wicked-functions-for-bo.patch
  - 0005-hcnmgr-maintain-hcnid-state-for-later-cleanup.patch
  - 0006-Add-hcn-init.service.suse.patch
  - 0007-Fix-NM-HNV-setting-primary-slave.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1664884800">- Fix "lsslot -c mem" output when LMB size is set to 4GB (bsc#1202777 ltc#199300)
  + lsslot-Fix-lsslot-c-mem-output-when-using-4GB-LMB-si.patch
  + lsslot-Explicity-declare-that-lmb_address-be-display.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1668427200">- NVMf boot support (bsc#1205351 ltc#200481)
  + bootlist-Add-install-boot-support-for-nvmf-devices.patch
  + ofpathname-Fix-several-issues-in-nvmf-boot-install-s.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1669291200">- nsid of nvmf device needs to be lowercase (bsc#1205697 ltc#200594)
  + ofpathname-Handle-nsid-as-hex-in-nvmf-boot-install-s.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1669809600">- Support multiple dev paths for a nvmf boot device (bsc#1205696 ltc#200595)
  + Support-multiple-dev-paths-for-a-nvmf-boot-device.patch</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="msuchanek@suse.com" date="1672660800">- Fix lparstat cpu mode display in a dedicated-donating LPAR (bsc#1206518 ltc#200949)
  + lparstat-Fix-display-of-mode-for-dedicated-donating-.patch
- Fix cpu utilization display
  + lparstat-Fix-array-overflow-issue.patch
- Fix setting primaty HNV link when using NM
  + hcnmgr-Fix-setting-primary-slave-across-reboots.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1674648000">- Update to version 1.3.11 (jsc#PED-560)
  - Add support for drmgr hooks.
- Drop upstreamed patches
  - Support-multiple-dev-paths-for-a-nvmf-boot-device.patch
  - bootlist-Add-install-boot-support-for-nvmf-devices.patch
  - hcnmgr-Fix-setting-primary-slave-across-reboots.patch
  - lparstat-Fix-array-overflow-issue.patch
  - lparstat-Fix-display-of-mode-for-dedicated-donating-.patch
  - lsslot-Explicity-declare-that-lmb_address-be-display.patch
  - lsslot-Fix-lsslot-c-mem-output-when-using-4GB-LMB-si.patch
  - ofpathname-Fix-several-issues-in-nvmf-boot-install-s.patch
  - ofpathname-Handle-nsid-as-hex-in-nvmf-boot-install-s.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1685966400">- Fix negative utilization value reported by lparstat -E (bsc#1212031)
  + lparstat-Fix-negative-values-seen-while-running-lpar.patch
- Fix lparstat error with mixed SMT state (bsc#1211883 ltc#02144)
  + lparstat-report-mixed-SMT-state.patch
  + lparstat-Fix-offline-threads-uninitialized-entries.patch</changelog>
</package>
<package pkgid="66519f2723ae6ed9d557d148ade8162c73a17930b7ef3350e7b07797f2e9d4c5" name="python-solv" arch="aarch64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="1a419276a61edd4bf5b5f03bda0e9b78ce9a6d8310af574299826a7c8f50ae11" name="python-solv" arch="ppc64le">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="8ab86d846aff4a0befcc9c03b378e3f51da571391a21709ca7bd7ceacbd3796b" name="python-solv" arch="s390x">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="fd8a9e5433a9059e9379d55c08ed69428eab47f9590d49516dea349e0e10a84d" name="python-solv" arch="x86_64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="553e421609d93103ddf558f265be4b072ed03cce8249920c5f7ecf0d138851bb" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="3bf2ef04e2d42b9cc16754ac6c793a482285a7492d353dd05e556684ee9568cb" name="python3" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="1cbc674ada21cf920f385ac9a48a673623a4412370fc5fcac8b1e2da5cf119c5" name="python3" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="0402b49dd026dafd3b59efb0f7df16be97be83f39c3d3370dee939f96b824925" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="7cd185ef9c3d2b83b76f7ec2c3596510c7aac3442324ccd796d9cff7fb708852" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="ad3b1891de41a1651638196268490c0ac17c101c0e7acb4bb173d2dc35580386" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="1d5de166e6c3170e9cb32217c44501f2027378b3114c81df5aee5034c005fe4c" name="python3-base" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="ce51f61573ba0f7980b6eaf4c9c4cb2b5da3b7649abb4362b2ddb3d51a757511" name="python3-base" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="b3c2043f8cb7670c70b1dcacc41ab26527123809352b89cdfc5dda10c897fa29" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="2c87a813380b52893f8dd3ad497ebe1ba81d493cef322f00c2f74920640615c3" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="45534edc86866e7d541b8cb6a3d7f1caae10b72d4c9ceab28284b845bb11f8c6" name="python3-curses" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="631377d102a97ec891592a23f6b80724836c4182cff33c4cbaf581d67dc65b0a" name="python3-curses" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="d27ff48ceb56b1866210df11509d9b5f985cf720f8e1b5f88aa1a99e2038c9d6" name="python3-curses" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="cad14c89e8a0d3306c5ebd8f986de33ab5e023ddaf4821e37f76e07b7779d170" name="python3-curses" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="b95790e112d4f92450209f7867479acb7607d55afff75e323fbcf0fed3881917" name="python3-dbm" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="ec105369485cc7f59cf6ee07e71ec37cbfe6989f2e17f134533f7fde4fcbb6eb" name="python3-dbm" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="63a7d5de8ddfc10cc043498efefeda35c7898173a7bf4b8d789d441e9a9c8e86" name="python3-dbm" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="4ef16e46a4243f10618b523a5ac37976ec0c882db81ae02a78778f311b6cf57b" name="python3-dbm" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="df9ba1494a6f93a5f7ae2ae40b386d30975b668e9eb6312841e7f58ce2ae6a71" name="python3-devel" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="c0190a5bf80962039cf9c91269382a74a74ab04d7cdd2c515f415e99b0bb3af0" name="python3-devel" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="c22cea66870da3a6ee06a9360329c3b9ae11fa11a75efcce31389a5ccad1fc97" name="python3-devel" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="38cb779c971ff711f20b045a1ed3af95fcd8ffc1c28ab92cdc8876abf18fede9" name="python3-devel" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="3473377ee3fcfe944ce21db88e13131b5e29e9fdb9c295aff873a7eea7a751fa" name="python3-doc" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="810a8d73ca2c879e553c6a305082b45c13d6cc7c713df184c1a57aafd2c1af5f" name="python3-doc" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="60475968a77673a0700749e3c30eb9ede9d92563b939974447007793b10fc5b2" name="python3-doc" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="518a26f56ed3d49ff68f65143697037c978828187b0804fa98d143e7e8e85c6e" name="python3-doc" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="c075021a333050e3939e79ecaa40a386ee3f2f9d26ef850661416482ab45074c" name="python3-doc-devhelp" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="6242d149e1a540b66af08db3c91da7151cfad58737f7afef211cf5e62be9f9e2" name="python3-doc-devhelp" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="9e416c84bc3c738259a6c08b43684c85e6b2bb1ded27f5a2910e2f314197e945" name="python3-doc-devhelp" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="9bd067bb8f234b0b83fecf1a2a442796e2db3b46507a1e3104e845f025bee30f" name="python3-doc-devhelp" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="26e0c089fffd0e2c157a155351ae9305dc1a91dc54b1a4c29e00f8d2268eae84" name="python3-documentation" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="59dc8b7b674eaf09c37ade6c47e42c62cc08e30233c1c8fa7ec594b38bcceebd" name="python3-idle" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="f5b513d2c46c64e757ba79d27b562c4aa53af20f09cc0d14c805425637b9cc3c" name="python3-idle" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="65eb3cef751e7c3e8be4d7c532fc5283fd11b3c176db4ad5220aa0db10f79914" name="python3-idle" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="6a6b9573d2b541079da781d6b2620a32de8101ba2b03873081f0d29e3c9dc35b" name="python3-idle" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="7b287f06cc3c28ec0841748797181e55a950d972040be2cb8b9ab9c713d89db5" name="python3-libnvme" arch="aarch64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="e1a06a48dd96a7947bc047b07f24e23aa0ba30d5882233a3858fde6759e48896" name="python3-libnvme" arch="ppc64le">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="56c46112baa753af590e059e0ca57638617294af9d0af04fb0ec797272eb7d95" name="python3-libnvme" arch="s390x">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="858da39c9f11b39908af3979e7d90769155d822898039d23ed2cebf0ce9635ed" name="python3-libnvme" arch="x86_64">
  <version epoch="0" ver="1.4+18.g932f9c37e05a" rel="150500.4.3.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
</package>
<package pkgid="b56da6ede4fc06869ae12c466dee41a85fa6a6fb0b8fd5629d803cc2a2c80a0a" name="python3-net-snmp" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="4108679eacbcf241c9e5d279d2fbc4eeec1694d90ed82b3b503e3aff062323bf" name="python3-net-snmp" arch="ppc64le">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="6503c54c9345856868ab1e9ab33fa56ca8071fa7b86cae2e6d69512f5b6cc4f3" name="python3-net-snmp" arch="s390x">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="d69f00e80eadac5bb2f28248810ff9f1b42fdd74e5acbad4d6082123c55413e1" name="python3-net-snmp" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="d430986e0af1f26df6b0003d01640d8cf3e46dea41ac28fdb5da2a7e0fe5a38c" name="python3-ovs" arch="aarch64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="8f0e2ad7ade6ee5a5752645eaf182792777c132ed901c810b84060df4952de81" name="python3-ovs" arch="ppc64le">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="ae8c375324ffcfe84b4b94484ea8f8018d8318c512abefbadabfd47aad298f6b" name="python3-ovs" arch="s390x">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="f388351caac9541fc0f841ff87f26120d10d8d8fe1f8f449b7151a0392bc483f" name="python3-ovs" arch="x86_64">
  <version epoch="0" ver="2.14.2" rel="150400.24.9.1"/>
  <changelog author="jcaamano@suse.com" date="1556539200">- Fix problem preventing new installs to run as non root (bsc#1132029),
  including:
  * Align with upstream so that no running configuration is changed on
    upgrades, specifically to avoid changes on the user Open vSwitch runs
    under.
  * hugetblfs groups is created as system group.
- Add missing opnvswitch-ipsec package and systemd service.
- Add patch to use strongswan instead of libreswan for openvswitch-ipsec.
  libreswan package not available currently.
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch
- Add missing ovs-delete-transient-ports systemd service.
- Align installed headers with upstream.
- Fix problem preventing rpm build '--with check'.
- Fix python environment that had directories pointing to /usr/local.
- Version bump to 2.11.1. Some of the changes are:
  * netdev-tc-offloads: Fix probe tc block support
  * rhel: Include all header files in the Fedora's devel package
  * reconnect.c: Don't transition back to ACTIVE when forced to RECONNECT.
  * OVN: Make periodic RAs consistent with RA responder.
  * OVN: Always send prefix option in RAs
  * OVN: Use offset instead of pointer into ofpbuf
  * ofproto: fix the bug of bucket counter is not updated
  * netdev-dpdk: Print netdev name for txq mapping.
  * dpif-netdev-perf: Fix millisecond stats precision with slower TSC.
  * ifupdown.sh: Add missing "--may-exist" option
  * dpif-netdev-perf: Fix double update of perf histograms.
  * dpdk: Stop dumping memzones to stdout.
  * dpctl: Drop parser debug information.
  * netdev-tc-offloads: Properly get the block id on flow del/get
  * netdev-tc-offloads: Improve log message for icmpv6 offload not supported
  * conntrack: Replace structure copy by memcpy().
  * conntrack: Lookup only 'UNNAT conns' in 'nat_clean()'.
  * conntrack: Fix race for NAT cleanup.
  * ovn-nbctl: Don't segfault when ovn-northd doesn't configure dynamic addresses.
  * datapath-windows: Add annotations to find vport functions
  * datapath-windows: Guard vport usage in user.c
  * datapath-windows: Fix potential deadlock in event subscription
  * datapath-windows: Fix race condition during port creation
  * datapath-windows: Fix nbl cleanup when memory allocation fails
  * netdev-linux: Remove ingress qdisc before trying to add shared block
  * netdev-tc-offloads: Remove ingress qdisc on tc init flow api
  * ovsdb-idl: Fix memory leak of idl-&gt;remote.
  * travis: Remove 'sudo' configuration.
  * OVN: Add port addresses to IPAM after all ports are joined.
  * dpif-netlink: Free leaked ofpbuf by using ofpbuf_delete
  * OVN: update RA next_announce according to {min, max}_interval
  * rconn: Avoid occasional immediate connection failures.
  * dpdk: Fix case-sensitivity of dpdk-init knob.
  * NEWS: Clean up the 2.11.0 release notes a bit.
  * conntrack: Fix L4 csum for V6 extension hdr pkts.
  * packets: Change return type for 'packet_csum_upperlayer6()'.
  * ovsdb-client: Fix typo.
  * ovn-nbctl: Daemon mode should retry when IDL connection lost.
  * ofctl: break the loop if ovs_pcap_read returns error
  * netlink: added check to prevent netlink attribute overflow</changelog>
  <changelog author="jcaamano@suse.com" date="1557144000">- Use temporary directory for python build.</changelog>
  <changelog author="jcaamano@suse.com" date="1560168000">- Add upstream patches to fix bsc#1135884:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1561032000">- Update DPDK dependency to support DPDK 18.11.2.</changelog>
  <changelog author="jcaamano@suse.com" date="1563278400">- Add unbound as a build requirement to support asynchronous DNS
  resolving for remotes.</changelog>
  <changelog author="jcaamano@suse.com" date="1565265600">- Fixed missing obsoletes for old python-ovs (bsc#1138948).</changelog>
  <changelog author="jcaamano@suse.com" date="1572264000">- Update openvswitch to 2.12.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/master/NEWS
- Removed patches that are already included upstream:
  * 0001-rhel-secure-openvswitch-useropts.patch
  * 0002-rhel-let-ctl-handle-runtime-directory.patch
- Rebased patches:
  * 0001-Use-strongswan-for-openvswitch-ipsec-service.patch</changelog>
  <changelog author="dmueller@suse.com" date="1581595200">- add missing sortedcontainers dependency to the python bindings</changelog>
  <changelog author="jcaamano@suse.com" date="1588593600">- Update openvswitch to 2.13.0.
  * For a list of changes, check
    https://github.com/openvswitch/ovs/blob/v2.13.0/NEWS
  * This version drops python2 binding support. Only python3 bindings
    provided going forward.
  * Tool ovs-vlan-bug-workaround is no longer provided.
- OVN was split to its own repo but is still built together with OVS and as
  such from this same source package. OVN initial version is 20.03.
  * For a list of changes, check
    https://github.com/ovn-org/ovn/blob/v20.03.0/NEWS
  * Packages openvswitch-ovn* are renamed to ovn*.
  * OVN now has its own sysconfig and log paths.
- Add OVS patch to be proposed upstream:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
- Patch instead of post-processing configuration files to set running
  credentials (bsc#1157338):
  * 0001-Run-openvswitch-as-openvswitch-openvswitch.patch
  * 0001-Run-ovn-as-openvswitch-openvswitch.patch
- Will no longer change group ownership of /dev/hugepages to 'hugetlbfs'
  (bsc#1140835). System admin should mount hugepages on a path and permissions of
  his choosing for OVS. Add patch:
  * 0001-Don-t-change-permissions-of-dev-hugepages.patch
- Will no longer install udev rule to change group ownership of vfio devices to
  'hugetlbfs'. Group name does not make much sense in this case and ownership of
  vfio devices should be coordinated system wide or per device.
- Will no longer run under group 'hugetlbfs' on new installs with DPDK enabled.
  OVS will now run under group 'openvswitch' whether compiled with DPDK support
  or not.
- OVS persistent state is now saved on /var/lib/openvswitch instead of
  /etc/openvswitch for new installs.</changelog>
  <changelog author="jcaamano@suse.com" date="1591185600">- add missing provides/obsoletes for python3-openvswitch-test</changelog>
  <changelog author="jcaamano@suse.com" date="1592222400">- Fix preserving old default OVS_USER_ID for users that removed the
  override at /etc/sysconfig/openvswitch or for users affected by
  fillup bug below (bsc#1172861).
- Add patch to workaround a possible fillup issue that could cause
  existing openvswitch configuration to be unintendedly altered during
  upgrades (bsc#1172929).
  * 0001-Use-double-hash-for-OVS_USER_ID-comment.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1598961600">- Update openvswitch to 2.14.0. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.0/NEWS
- Update OVN to 20.06.2. For a list of changes, check
  https://github.com/ovn-org/ovn/blob/v20.06.2/NEWS</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Fix wrong default directories for OVS python utilities (bsc#1176273).
- Add upstream patches to fix openvswitch-ipsec service (bsc#1176273).
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1604404800">- Replaced `%service_del_postun -n` with `%service_del_postun_without_restart`
  (bsc#1117483).</changelog>
  <changelog author="jcaamano@suse.com" date="1613131200">- Update openvswitch to 2.14.2. For a list of changes, check
  https://github.com/openvswitch/ovs/blob/v2.14.2/NEWS
  Includes security fix for CVE-2020-27827 (bsc#1181345) and CVE-2020-35498
  (bsc#1181742).
- Removed patches no longer applying to code base:
  * 0001-rhel-Fix-reload-of-OVS_USER_ID-on-startup.patch
  * 0001-ipsec-Fix-Strongswan-configuration-syntax.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1619697600">- Replace deprecated /var/run with /run (bsc#1185176, bsc#1185177).
  * 0001-Replace-deprecated-var-run-with-run.patch</changelog>
  <changelog author="dmueller@suse.com" date="1620648000">- add openssl(cli) dependency on pki (bsc#1185839)</changelog>
  <changelog author="pgajdos@suse.com" date="1661342400">- security update
- added patches
  fix CVE-2021-36980 [bsc#1188524], use-after-free in decode_NXAST_RAW_ENCAP
  + openvswitch-CVE-2021-36980.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684238400">- added patch to include fix for CVE-2022-4338 (bsc#1206580) and CVE-2022-4337(bsc#1206581) when parsing malformed LLDP packets
  * CVE-2022-4338.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1684497600">- Fix CVE-2023-1668 [bsc#1210054], openvswitch: remote traffic denial of service via crafted packets with IP proto 0
- Added patch,
    CVE-2023-1668.patch</changelog>
</package>
<package pkgid="7e9ea4a52b2dc3f734263d8ea43fa058f18f2c2a6a77f40c859ccb6da072a5b5" name="python3-solv" arch="aarch64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="42af7afd74a495b419850561ace906a622fee42b619f6b22dd279fb48c6b03e6" name="python3-solv" arch="ppc64le">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="6363c203d7f49a0bd1bb8bd56f470b1136d6fdaceb26a9de8cbf332298a8b990" name="python3-solv" arch="s390x">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="7f45526143a210be1d670c382d634d691128afa0dcf99fa449bf3c23190f1854" name="python3-solv" arch="x86_64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="ebbd25c8a85a595dd15baf7e5cff2f4f9317e61c5b1e684dbe8e59fe16440dfb" name="python3-testsuite" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="3bb3f76da8980ca679e9f19e269a00cf002194653e9d12238e9db3cb87c330f5" name="python3-testsuite" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="2c636156dc437f2cd736594ce0dd14118565385c967ebb9cdb8009b00600b58f" name="python3-testsuite" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="9eb66aecf194cf6602468d049ab2cebf01580750133bfc2cf96b3fda21775f10" name="python3-testsuite" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="be5db8f4883d7e174c289c7e34d9205db9b5464205dc384b7c4b0f4cada74086" name="python3-tk" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="2703c9ab3f7131fa95b5e2d730e82793ec37d86b9b1084d39d4fe71c3b8ac49c" name="python3-tk" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="589aa19dd37ff61bc0bf2fa69c4ce25829bffde473966a00a0b4159b21ed00a0" name="python3-tk" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="45ccacfd7d31670a44800e1d5a1d4852208e881c6b65b7404ad386cafa675384" name="python3-tk" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="a04c72d6c7428cea1abe71a70f5a6668757de5e339bf470e58e90debe8c531da" name="python3-tools" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="3d81ba24b25d6299e4bbb06d0d42a92584d3f4918797c4c8112e419553889bc1" name="python3-tools" arch="ppc64le">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="44283c88c0f0ab5fad1b04545a8eae7d384997e521baed721f7d6da61e7dce87" name="python3-tools" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="64f8ccd4a1ec7ec1f0b179d10c5ebd1573d6e69ae7fcc70f6ab53bc79d858c03" name="python3-tools" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.48.1"/>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
</package>
<package pkgid="a2f2414e6318636a10d14427d00baed859120db80c70633f5bde8088c5b3e7bb" name="python310" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="bbf75535ae24b9ab7b3c8959df637d10301884d8ece24e08760ef73258b8d573" name="python310" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="65d99b7027d991134754cf07b9eab1e374e880f954b8118e5edfd3d73845762a" name="python310" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="18d65d988e2998a704d72f5f20f414bb4e6da240d0f7515aed497ed69ddd51c2" name="python310" arch="src">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="8e9eab9e2022ae945f9e6f3bfc054deea67c50752fcb0dc5a73259f663e55112" name="python310" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="45ee0b46117f51dbdefc403e8aeab71324a7ce79c251b3a7ae1e6008b681f940" name="python310-32bit" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="6b15b0715a24b6365b6b08a6cf70a93c47de0c51383fb2117da40b8459faabff" name="python310-base" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="b2d181ad9adb7425169d509da1062ab443e0f7f0ddddb7a2a0f6e6261133bd6e" name="python310-base" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="3f83c4bea636a0f1646c1e5c30f89e26295bc1248d8d2de5ffd7fdf5a07d4628" name="python310-base" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="143fa1121b488e1a572137e6956c7c209ec875e9fac2aff07bd05def88f0f834" name="python310-base" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="33aa097e04296887a8d4e85cd3326503d2668d4ab137108ef0251076c766ab32" name="python310-base-32bit" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="ad91af403820c8ae000de22a957e8f97ef7d346bf839cec5e90a7c4f53e0dcea" name="python310-core" arch="src">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="f52995c0d3ffcd77a526eb920720146af07b29cae4eddb62c53d09a93c1bcac8" name="python310-curses" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="3039036ace644add83d572fa552e9ef9523829655d63da5f6e565dbfc613f2a5" name="python310-curses" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="16c45ab30348a51598eb74e7bfc5b2a622f3cbdbea7eae1d4086e0515707ac18" name="python310-curses" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="6dd82ade901f844d2a67344ec92edc2c5198a5fd4eaa8f05cbea15f9808cf9a0" name="python310-curses" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="fc75f135b2c8408dbb94cf7c1d4089191f6b9e9503ad4594f8d8e305464406a9" name="python310-dbm" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="69da26f06daa58b43f3b30d15c1d0496c58ceecc77f4f0274deb75f5dfec34cb" name="python310-dbm" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="334ba11e855f8120f5571cca5fd41e0f5540111c46b5331f0ec54c136ac529d8" name="python310-dbm" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="f04643870135e73b08457e11c98ce7f8854f5e7aa5a199bb8cbf86c057f2255b" name="python310-dbm" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="2189a1aa752957fb343509bb1a229848c8dce6d9d9830e739f7b5429e17d2a9d" name="python310-devel" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="eaa9565b595296cae661df4b59e26ce3c455256633e20bcdbe9ecc68c7197a1b" name="python310-devel" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="696fdf8ca1544f376997b708a7e907b4422faa47b75c06b9375d3553c7b7b5a8" name="python310-devel" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="1c846c169ef97fc31a37a9a45a678ffe66495bd185428a99e51dd9e8590af2b1" name="python310-devel" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="d15477f96eeda8367724a888552242fe511b632010c05077dbaa05257d6ff05f" name="python310-doc" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="545d8a4a4d1965e39040b9ebc7a80d123cfa14eeb369143fd031d4a1f32cb0f6" name="python310-doc" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="ddb106a50b74522bdbbd718cc0fc56d185aabdc776f45292e3eb33e708bc9387" name="python310-doc" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="c243af08f59b5241e3f1d8225c4ed2bd6a8a3bcd4f7df5e1145ef96b70802be4" name="python310-doc" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="b282eaa8915a23e05dade048fea021b04937993b95774062656d562da8ec5a58" name="python310-doc-devhelp" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="3ffd7016610c98007c7db42afd4a6bdaac66c8c80a7639d0d72b0341bafa5f5e" name="python310-doc-devhelp" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="55c5cd7146ab3b82b85abc89dd1289fbd9ac0e9be32cec2b3fd9ac4c3ff95ddd" name="python310-doc-devhelp" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="7489dff4e0a5edb9cf5c6121fc9c7263722557c04347d8da28cedcccddcfec67" name="python310-doc-devhelp" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="63d1b82b24c9c199806c42871514eeb855406c0fe9d3fef6e03f68addc11078c" name="python310-documentation" arch="src">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="eee15876ad1713b0075df3386a2e38173922feaa672e41eda044dfb819cfc3d6" name="python310-idle" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="da072139699cf770be01d9f276c8bc76d47a174a9d92a9627ebe7dea8a0f828c" name="python310-idle" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="a8f183f0da896c688a60f0eefb92845ca70322edd9c6b1d38f9b798f53354da9" name="python310-idle" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="3c5e2cf63c264fab5e5ad4f1d2d4375b6d856163f02b41c18c7cf7c284300f70" name="python310-idle" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="535d5af8fcc792c820720d51c10bf295ab032d2a37a2b01a156d2a47103364ae" name="python310-testsuite" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="4b24e601dba7cc52809c18ecf2893d0c80f2620ed602837e2b15201bef7303a4" name="python310-testsuite" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="75244210912828cdd8204ae42cfc14e1e8953a49cf2533a2378bf30d7c865b1b" name="python310-testsuite" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="6f4236f187f9bbe401acef1b7776c142ba198e3f7a1423706545b889a7cf686d" name="python310-testsuite" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="4e3f7f7c1d89172494822ddacfcb0605dc9478cb6aefe9411419e16ed3b22db0" name="python310-tk" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="924dc92bd3abed1af25089be90aa5aa07a5cb1ff20bbaac15ff54d24dee453fa" name="python310-tk" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="5d08c8b1637931e0b848b9e1e114d2f36d9630bb42d18b633d4388425a500ad8" name="python310-tk" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="fef6c556b732c4e5409af6c7e2cda233ad4199e04dd04b98e8e8d27dffaa38ca" name="python310-tk" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="b9ae1f6918028136d3bb2853dbb1f4fcb0b66ce89dc2671e0f4933a979bd5854" name="python310-tools" arch="aarch64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="ef3d060a644c4816eec515e0faf4b13c0c6f1cbd081944670a72b003abba5695" name="python310-tools" arch="ppc64le">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="a4533299b7275c0e758aca51bab25e3070881478e2025593942eb1f4d2587c34" name="python310-tools" arch="s390x">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="fae1c0684538320592857aa4b7a5ec86a7fa11f8dab0e3356a41506fa6550168" name="python310-tools" arch="x86_64">
  <version epoch="0" ver="3.10.11" rel="150400.4.25.1"/>
  <changelog author="mcepl@suse.com" date="1652184000">- Refresh bluez-devel-vendor.tar.xz</changelog>
  <changelog author="mcepl@suse.com" date="1654516800">- Update to 3.10.5:
  - Core and Builtins
  - gh-93418: Fixed an assert where an f-string has an equal
    sign ‘=’ following an expression, but there’s no trailing
    brace. For example, f”{i=”.
  - gh-91924: Fix __ltrace__ debug feature if the stdout
    encoding is not UTF-8. Patch by Victor Stinner.
  - gh-93061: Backward jumps after async for loops are no
    longer given dubious line numbers.
  - gh-93065: Fix contextvars HAMT implementation to handle
    iteration over deep trees.
  - The bug was discovered and fixed by Eli Libman. See
    MagicStack/immutables#84 for more details.
  - gh-92311: Fixed a bug where setting frame.f_lineno to jump
    over a list comprehension could misbehave or crash.
  - gh-92112: Fix crash triggered by an evil custom mro() on
    a metaclass.
  - gh-92036: Fix a crash in subinterpreters related to the
    garbage collector. When a subinterpreter is deleted,
    untrack all objects tracked by its GC. To prevent a crash
    in deallocator functions expecting objects to be tracked by
    the GC, leak a strong reference to these objects on
    purpose, so they are never deleted and their deallocator
    functions are not called. Patch by Victor Stinner.
  - gh-91421: Fix a potential integer overflow in
    _Py_DecodeUTF8Ex.
  - bpo-47212: Raise IndentationError instead of SyntaxError
    for a bare except with no following indent. Improve
    SyntaxError locations for an un-parenthesized generator
    used as arguments. Patch by Matthieu Dartiailh.
  - bpo-47182: Fix a crash when using a named unicode character
    like "\N{digit nine}" after the main interpreter has been
    initialized a second time.
  - bpo-47117: Fix a crash if we fail to decode characters in
    interactive mode if the tokenizer buffers are
    uninitialized. Patch by Pablo Galindo.
  - bpo-39829: Removed the __len__() call when initializing
    a list and moved initializing to list_extend. Patch by
    Jeremiah Pascual.
  - bpo-46962: Classes and functions that unconditionally
    declared their docstrings ignoring the
  - -without-doc-strings compilation flag no longer do so.
  - The classes affected are ctypes.UnionType,
    pickle.PickleBuffer, testcapi.RecursingInfinitelyError, and
    types.GenericAlias.
  - The functions affected are 24 methods in ctypes.
  - Patch by Oleg Iarygin.
  - bpo-36819: Fix crashes in built-in encoders with error
    handlers that return position less or equal than the
    starting position of non-encodable characters.
  - Library
  - gh-93156: Accessing the pathlib.PurePath.parents sequence
    of an absolute path using negative index values produced
    incorrect results.
  - gh-89973: Fix re.error raised in fnmatch if the pattern
    contains a character range with upper bound lower than
    lower bound (e.g. [c-a]). Now such ranges are interpreted
    as empty ranges.
  - gh-93010: In a very special case, the email package tried
    to append the nonexistent InvalidHeaderError to the defect
    list. It should have been InvalidHeaderDefect.
  - gh-92839: Fixed crash resulting from calling
    bisect.insort() or bisect.insort_left() with the key
    argument not equal to None.
  - gh-91581: utcfromtimestamp() no longer attempts to resolve
    fold in the pure Python implementation, since the fold is
    never 1 in UTC. In addition to being slightly faster in the
    common case, this also prevents some errors when the
    timestamp is close to datetime.min. Patch by Paul Ganssle.
  - gh-92530: Fix an issue that occurred after interrupting
    threading.Condition.notify().
  - gh-92049: Forbid pickling constants re._constants.SUCCESS
    etc. Previously, pickling did not fail, but the result
    could not be unpickled.
  - bpo-47029: Always close the read end of the pipe used by
    multiprocessing.Queue after the last write of buffered data
    to the write end of the pipe to avoid BrokenPipeError at
    garbage collection and at multiprocessing.Queue.close()
    calls. Patch by Géry Ogam.
  - gh-91401: Provide a fail-safe way to disable subprocess use
    of vfork() via a private subprocess._USE_VFORK attribute.
    While there is currently no known need for this, if you
    find a need please only set it to False. File a CPython
    issue as to why you needed it and link to that from
    a comment in your code. This attribute is documented as
    a footnote in 3.11.
  - gh-91910: Add missing f prefix to f-strings in error
    messages from the multiprocessing and asyncio modules.
  - gh-91810: ElementTree method write() and function
    tostring() now use the text file’s encoding (“UTF-8” if not
    available) instead of locale encoding in XML declaration
    when encoding="unicode" is specified.
  - gh-91832: Add required attribute to argparse.Action repr
    output.
  - gh-91700: Compilation of regular expression containing
    a conditional expression (?(group)...) now raises an
    appropriate re.error if the group number refers to not
    defined group. Previously an internal RuntimeError was
    raised.
  - gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
    the per test event loop executor before returning from its
    run method so that a not yet stopped or garbage collected
    executor state does not persist beyond the test.
  - gh-90568: Parsing \N escapes of Unicode Named Character
    Sequences in a regular expression raises now re.error
    instead of TypeError.
  - gh-91595: Fix the comparison of character and integer
    inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
  - gh-90622: Worker processes for
    concurrent.futures.ProcessPoolExecutor are no longer
    spawned on demand (a feature added in 3.9) when the
    multiprocessing context start method is "fork" as that can
    lead to deadlocks in the child processes due to a fork
    happening while threads are running.
  - gh-91575: Update case-insensitive matching in the re module
    to the latest Unicode version.
  - gh-91581: Remove an unhandled error case in the
    C implementation of calls to datetime.fromtimestamp with no
    time zone (i.e. getting a local time from an epoch
    timestamp). This should have no user-facing effect other
    than giving a possibly more accurate error message when
    called with timestamps that fall on 10000-01-01 in the
    local time. Patch by Paul Ganssle.
  - bpo-47260: Fix os.closerange() potentially being a no-op in
    a Linux seccomp sandbox.
  - bpo-39064: zipfile.ZipFile now raises zipfile.BadZipFile
    instead of ValueError when reading a corrupt zip file in
    which the central directory offset is negative.
  - bpo-47151: When subprocess tries to use vfork, it now falls
    back to fork if vfork returns an error. This allows use in
    situations where vfork isn’t allowed by the OS kernel.
  - bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
    names for socket.AF_INET or socket.AF_INET6 families.
    Resolution may not make sense for other families, like
    socket.AF_BLUETOOTH and socket.AF_UNIX.
  - bpo-43323: Fix errors in the email module if the charset
    itself contains undecodable/unencodable characters.
  - bpo-47101: hashlib.algorithms_available now lists only
    algorithms that are provided by activated crypto providers
    on OpenSSL 3.0. Legacy algorithms are not listed unless the
    legacy provider has been loaded into the default OSSL
    context.
  - bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
    exception memory leak
  - bpo-45393: Fix the formatting for await x and not x in the
    operator precedence table when using the help() system.
  - bpo-46415: Fix ipaddress.ip_{address,interface,network}
    raising TypeError instead of ValueError if given invalid
    tuple as address parameter.
  - bpo-28249: Set doctest.DocTest.lineno to None when object
    does not have __doc__.
  - bpo-45138: Fix a regression in the sqlite3 trace callback
    where bound parameters were not expanded in the passed
    statement string. The regression was introduced in Python
    3.10 by bpo-40318. Patch by Erlend E. Aasland.
  - bpo-44493: Add missing terminated NUL in sockaddr_un’s
    length
  - This was potentially observable when using non-abstract
    AF_UNIX datagram sockets to processes written in another
    programming language.
  - bpo-42627: Fix incorrect parsing of Windows registry proxy
    settings
  - bpo-36073: Raise ProgrammingError instead of segfaulting on
    recursive usage of cursors in sqlite3 converters. Patch by
    Sergey Fedoseev.
  - Documentation
  - gh-86438: Clarify that -W and PYTHONWARNINGS are matched
    literally and case-insensitively, rather than as regular
    expressions, in warnings.
  - gh-92240: Added release dates for “What’s New in Python
    3.X” for 3.0, 3.1, 3.2, 3.8 and 3.10
  - gh-91888: Add a new gh role to the documentation to link to
    GitHub issues.
  - gh-91783: Document security issues concerning the use of
    the function shutil.unpack_archive()
  - gh-91547: Remove “Undocumented modules” page.
  - bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
    shutil.copytree().
  - bpo-38668: Update the introduction to documentation for
    os.path to remove warnings that became irrelevant after the
    implementations of PEP 383 and PEP 529.
  - bpo-47138: Pin Jinja to a version compatible with Sphinx
    version 3.2.1.
  - bpo-46962: All docstrings in code snippets are now wrapped
    into PyDoc_STR() to follow the guideline of PEP 7’s
    Documentation Strings paragraph. Patch by Oleg Iarygin.
  - bpo-26792: Improve the docstrings of runpy.run_module() and
    runpy.run_path(). Original patch by Andrew Brezovsky.
  - bpo-40838: Document that inspect.getdoc(),
    inspect.getmodule(), and inspect.getsourcefile() might
    return None.
  - bpo-45790: Adjust inaccurate phrasing in Defining Extension
    Types: Tutorial about the ob_base field and the macros used
    to access its contents.
  - bpo-42340: Document that in some circumstances
    KeyboardInterrupt may cause the code to enter an
    inconsistent state. Provided a sample workaround to avoid
    it if needed.
  - bpo-41233: Link the errnos referenced in
    Doc/library/exceptions.rst to their respective section in
    Doc/library/errno.rst, and vice versa. Previously this was
    only done for EINTR and InterruptedError. Patch by Yan
    “yyyyyyyan” Orestes.
  - bpo-38056: Overhaul the Error Handlers documentation in
    codecs.
  - bpo-13553: Document tkinter.Tk args.
  - Tests
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_imaplib.py.
  - gh-92670: Skip
    test_shutil.TestCopy.test_copyfile_nonexistent_dir test on
    AIX as the test uses a trailing slash to force the OS
    consider the path as a directory, but on AIX the trailing
    slash has no effect and is considered as a file.
  - gh-91904: Fix initialization of
    PYTHONREGRTEST_UNICODE_GUARD which prevented running
    regression tests on non-UTF-8 locale.
  - gh-91607: Fix test_concurrent_futures to test the correct
    multiprocessing start method context in several cases where
    the test logic mixed this up.
  - bpo-47205: Skip test for sched_getaffinity() and
    sched_setaffinity() error case on FreeBSD.
  - bpo-47104: Rewrite asyncio.to_thread() tests to use
    unittest.IsolatedAsyncioTestCase.
  - bpo-29890: Add tests for ipaddress.IPv4Interface and
    ipaddress.IPv6Interface construction with tuple arguments.
    Original patch and tests by louisom.
  - Tools/Demos
  - gh-91583: Fix regression in the code generated by Argument
    Clinic for functions with the defining_class parameter.</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
  %primary_interpreter.</changelog>
  <changelog author="mcepl@suse.com" date="1658404800">- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).</changelog>
  <changelog author="coolo@suse.com" date="1659268800">- Extend distutils-reproducible-compile.patch with a workaround
  for non reproducible pyc files issue 93317</changelog>
  <changelog author="mcepl@suse.com" date="1659441600">- Update to 3.10.6:
  - gh-87389: http.server: Fix an open redirection vulnerability
    in the HTTP server when an URI path starts with //.
    Vulnerability discovered, and initial fix proposed, by Hamza
    Avvan. (bsc#1202624, CVE-2021-28861)
  - gh-92888: Fix memoryview use after free when accessing the
    backing buffer in certain cases.
  - gh-95355: _PyPegen_Parser_New now properly detects token
    memory allocation errors. Patch by Honglin Zhu.
  - gh-94938: Fix error detection in some builtin functions when
    keyword argument name is an instance of a str subclass with
    overloaded __eq__ and __hash__. Previously it could cause
    SystemError or other undesired behavior.
  - gh-94949: ast.parse() will no longer parse parenthesized
    context managers when passed feature_version less than
    (3, 9). Patch by Shantanu Jain.
  - gh-94947: ast.parse() will no longer parse assignment
    expressions when passed feature_version less than
    (3, 8). Patch by Shantanu Jain.
  - gh-94869: Fix the column offsets for some expressions in
    multi-line f-strings ast nodes. Patch by Pablo Galindo.
  - gh-91153: Fix an issue where a bytearray item assignment
    could crash if it’s resized by the new value’s __index__()
    method.
  - gh-94329: Compile and run code with unpacking of extremely
    large sequences (1000s of elements). Such code failed to
    compile. It now compiles and runs correctly.
  - gh-94360: Fixed a tokenizer crash when reading encoded
    files with syntax errors from stdin with non utf-8 encoded
    text. Patch by Pablo Galindo
  - gh-94192: Fix error for dictionary literals with invalid
    expression as value.
  - gh-93964: Strengthened compiler overflow checks to prevent
    crashes when compiling very large source files.
  - gh-93671: Fix some exponential backtrace case happening with
    deeply nested sequence patterns in match statements. Patch by
    Pablo Galindo
  - gh-93021: Fix the __text_signature__ for __get__() methods
    implemented in C. Patch by Jelle Zijlstra.
  - gh-92930: Fixed a crash in _pickle.c from mutating
    collections during __reduce__ or persistent_id.
  - gh-92914: Always round the allocated size for lists up to the
    nearest even number.
  - gh-92858: Improve error message for some suites with syntax
    error before ‘:’
  - gh-95339: Update bundled pip to 22.2.1.
  - gh-95045: Fix GC crash when deallocating _lsprof.Profiler by
    untracking it before calling any callbacks. Patch by Kumar
    Aditya.
  - gh-95087: Fix IndexError in parsing invalid date in the email
    module.
  - gh-95199: Upgrade bundled setuptools to 63.2.0.
  - gh-95194: Upgrade bundled pip to 22.2.
  - gh-93899: Fix check for existence of os.EFD_CLOEXEC,
    os.EFD_NONBLOCK and os.EFD_SEMAPHORE flags on older kernel
    versions where these flags are not present. Patch by Kumar
    Aditya.
  - gh-95166: Fix concurrent.futures.Executor.map() to cancel the
    currently waiting on future on an error - e.g. TimeoutError
    or KeyboardInterrupt.
  - gh-93157: Fix fileinput module didn’t support errors option
    when inplace is true.
  - gh-94821: Fix binding of unix socket to empty address
    on Linux to use an available address from the abstract
    namespace, instead of “0”.
  - gh-94736: Fix crash when deallocating an instance of a
    subclass of _multiprocessing.SemLock. Patch by Kumar Aditya.
  - gh-94637: SSLContext.set_default_verify_paths() now releases
    the GIL around SSL_CTX_set_default_verify_paths call. The
    function call performs I/O and CPU intensive work.
  - gh-94510: Re-entrant calls to sys.setprofile() and
    sys.settrace() now raise RuntimeError. Patch by Pablo
    Galindo.
  - gh-92336: Fix bug where linecache.getline() fails on bad
    files with UnicodeDecodeError or SyntaxError. It now returns
    an empty string as per the documentation.
  - gh-89988: Fix memory leak in pickle.Pickler when looking up
    dispatch_table. Patch by Kumar Aditya.
  - gh-94254: Fixed types of struct module to be immutable. Patch
    by Kumar Aditya.
  - gh-94245: Fix pickling and copying of typing.Tuple[()].
  - gh-94207: Made _struct.Struct GC-tracked in order to fix a
    reference leak in the _struct module.
  - gh-94101: Manual instantiation of ssl.SSLSession objects is
    no longer allowed as it lead to misconfigured instances that
    crashed the interpreter when attributes where accessed on
    them.
  - gh-84753: inspect.iscoroutinefunction(),
    inspect.isgeneratorfunction(), and
    inspect.isasyncgenfunction() now properly return True
    for duck-typed function-like objects like instances of
    unittest.mock.AsyncMock.
  - This makes inspect.iscoroutinefunction() consistent with the
    behavior of asyncio.iscoroutinefunction(). Patch by Mehdi
    ABAAKOUK.
  - gh-83499: Fix double closing of file description in tempfile.
  - gh-79512: Fixed names and __module__ value of weakref classes
    ReferenceType, ProxyType, CallableProxyType. It makes them
    pickleable.
  - gh-90494: copy.copy() and copy.deepcopy() now always raise
    a TypeError if __reduce__() returns a tuple with length 6
    instead of silently ignore the 6th item or produce incorrect
    result.
  - gh-90549: Fix a multiprocessing bug where a global named
    resource (such as a semaphore) could leak when a child
    process is spawned (as opposed to forked).
  - gh-79579: sqlite3 now correctly detects DML queries with
    leading comments. Patch by Erlend E. Aasland.
  - gh-93421: Update sqlite3.Cursor.rowcount when a DML
    statement has run to completion. This fixes the row count
    for SQL queries like UPDATE ... RETURNING. Patch by Erlend
    E. Aasland.
  - gh-91810: Suppress writing an XML declaration in open
    files in ElementTree.write() with encoding='unicode' and
    xml_declaration=None.
  - gh-93353: Fix the importlib.resources.as_file() context
    manager to remove the temporary file if destroyed late
    during Python finalization: keep a local reference to the
    os.remove() function. Patch by Victor Stinner.
  - gh-83658: Make multiprocessing.Pool raise an exception if
    maxtasksperchild is not None or a positive int.
  - gh-74696: shutil.make_archive() no longer temporarily changes
    the current working directory during creation of standard
    .zip or tar archives.
  - gh-91577: Move imports in SharedMemory methods to module
    level so that they can be executed late in python
    finalization.
  - bpo-47231: Fixed an issue with inconsistent trailing slashes
    in tarfile longname directories.
  - bpo-46755: In QueueHandler, clear stack_info from LogRecord
    to prevent stack trace from being written twice.
  - bpo-46053: Fix OSS audio support on NetBSD.
  - bpo-46197: Fix ensurepip environment isolation for subprocess
    running pip.
  - bpo-45924: Fix asyncio incorrect traceback when future’s
    exception is raised multiple times. Patch by Kumar Aditya.
  - bpo-34828: sqlite3.Connection.iterdump() now handles
    databases that use AUTOINCREMENT in one or more tables.
  - gh-94321: Document the PEP 246 style protocol type
    sqlite3.PrepareProtocol.
  - gh-86128: Document a limitation in ThreadPoolExecutor where
    its exit handler is executed before any handlers in atexit.
  - gh-61162: Clarify sqlite3 behavior when Using the connection
    as a context manager.
  - gh-87260: Align sqlite3 argument specs with the actual
    implementation.
  - gh-86986: The minimum Sphinx version required to build the
    documentation is now 3.2.
  - gh-88831: Augmented documentation of
    asyncio.create_task(). Clarified the need to keep strong
    references to tasks and added a code snippet detailing how to
    to this.
  - bpo-47161: Document that pathlib.PurePath does not collapse
    initial double slashes because they denote UNC paths.
  - gh-95280: Fix problem with test_ssl test_get_ciphers on
    systems that require perfect forward secrecy (PFS) ciphers.
  - gh-95212: Make multiprocessing test case
    test_shared_memory_recreate parallel-safe.
  - gh-91330: Added more tests for dataclasses to cover behavior
    with data descriptor-based fields.
  - gh-94208: test_ssl is now checking for supported TLS version
    and protocols in more tests.
  - gh-93951: In test_bdb.StateTestCase.test_skip, avoid
    including auxiliary importers.
  - gh-93957: Provide nicer error reporting from subprocesses in
    test_venv.EnsurePipTest.test_with_pip.
  - gh-57539: Increase calendar test coverage for
    calendar.LocaleTextCalendar.formatweekday().
  - gh-92886: Fixing tests that fail when running with
    optimizations (-O) in test_zipimport.py
  - bpo-47016: Create a GitHub Actions workflow for verifying
    bundled pip and setuptools. Patch by Illia Volochii and Adam
    Turner.
  - gh-94841: Fix the possible performance regression of
    PyObject_Free() compiled with MSVC version 1932.
  - gh-95511: Fix the Shell context menu copy-with-prompts bug of
    copying an extra line when one selects whole lines.
  - gh-95471: In the Edit menu, move Select All and add a new
    separator.
  - gh-95411: Enable using IDLE’s module browser with .pyw files.
  - gh-89610: Add .pyi as a recognized extension for IDLE on
    macOS. This allows opening stub files by double clicking on
    them in the Finder.
  - gh-94538: Fix Argument Clinic output to custom file
    destinations. Patch by Erlend E. Aasland.
  - gh-94430: Allow parameters named module and self with custom
    C names in Argument Clinic. Patch by Erlend E. Aasland
  - gh-94930: Fix SystemError raised when
    PyArg_ParseTupleAndKeywords() is used with # in (...) but
    without PY_SSIZE_T_CLEAN defined.
  - gh-94864: Fix PyArg_Parse* with deprecated format units “u”
    and “Z”. It returned 1 (success) when warnings are turned
    into exceptions.
- Reapply patches
  - bpo-31046_ensurepip_honours_prefix.patch
  - fix_configure_rst.patch
  - no-skipif-doctests.patch
  - skip-test_pyobject_freed_is_freed.patch</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- fix import_failed.map to refer to the python 3.10 package versions</changelog>
  <changelog author="mcepl@suse.com" date="1662897600">- Update to 3.10.7:
  - Fix for CVE-2020-10735 (bsc#1203125) Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises
    a ValueError if the number of digits in string form is above
    a limit to avoid potential denial of service attacks due to
    the algorithmic complexity.
  - Other bug fixes:
  - Fixed a bug that caused _PyCode_GetExtra to return garbage
    for negative indexes.
  - Fix format string in _PyPegen_raise_error_known_location
    that can lead to memory corruption on some 64bit systems.
    The function was building a tuple with i (int) instead of
    n (Py_ssize_t) for Py_ssize_t arguments.
  - Fix misleading contents of error message when converting an
    all-whitespace string to float.
  - coroutine.throw() now properly initializes the frame.f_back
    when resuming a stack of coroutines. This allows e.g.
    traceback.print_stack() to work correctly when an exception
    (such as CancelledError) is thrown into a coroutine.
  - ast.parse() will no longer parse function definitions with
    positional-only params when passed feature_version less
    than (3, 8).
  - Correct conversion of numbers.Rational’s to float.
  - Fix a performance regression in logging
    TimedRotatingFileHandler. Only check for special files when
    the rollover time has passed.
  - Fix unused localName parameter in the Attr class in
    xml.dom.minidom.
  - Update bundled pip to 22.2.2.
  - Fail gracefully if EPERM or ENOSYS is raised when loading
    crypt methods. This may happen when trying to load MD5 on
    a Linux kernel with FIPS enabled.
  - Improve discoverability of the higher level
    concurrent.futures module by providing clearer links from
    the lower level threading and multiprocessing modules.
  - Update the default RFC base URL from deprecated
    tools.ietf.org to datatracker.ietf.org
  - Fix stylesheet not working in Windows CHM htmlhelp docs.
  - The documentation now lists which members of C structs are
    part of the Limited API/Stable ABI.
  - Mitigate the inherent race condition from using
    find_unused_port() in testSockName() by trying to find an
    unused port a few times before failing.
  - Build and test with OpenSSL 1.1.1q
  - Document handling of extensions in Save As dialogs.
  - Include prompts when saving Shell (interactive input and
    output).</changelog>
  <changelog author="schwab@suse.de" date="1663502400">- test-int-timing.patch: gh-96710: Make the test timing more lenient for
  the int/str DoS regression test. (#96717)</changelog>
  <changelog author="mcepl@suse.com" date="1666180800">- Update to 3.10.8:
  - Fix multiplying a list by an integer (list *= int): detect
    the integer overflow when the new allocated length is close
    to the maximum size.
  - Fix a shell code injection vulnerability in the
    get-remote-certificate.py example script. The script no
    longer uses a shell to run openssl commands. (originally
    filed as CVE-2022-37460, later withdrawn)
  - Fix command line parsing: reject -X int_max_str_digits option
    with no value (invalid) when the PYTHONINTMAXSTRDIGITS
    environment variable is set to a valid limit.
  - When ValueError is raised if an integer is larger than the
    limit, mention the sys.set_int_max_str_digits() function in
    the error message.
  - The deprecated mailcap module now refuses to inject unsafe
    text (filenames, MIME types, parameters) into shell
    commands. Instead of using such text, it will warn and act
    as if a match was not found (or for test commands, as if the
    test failed).
  - os.sched_yield() now release the GIL while calling
    sched_yield(2).
  - Bugfix: PyFunction_GetAnnotations() should return a borrowed
    reference. It was returning a new reference.
  - Fixed a missing incref/decref pair in
    Exception.__setstate__().
  - Fix overly-broad source position information for chained
    comparisons used as branching conditions.
  - Fix undefined behaviour in _testcapimodule.c.
  - At Python exit, sometimes a thread holding the GIL can
    wait forever for a thread (usually a daemon thread) which
    requested to drop the GIL, whereas the thread already
    exited. To fix the race condition, the thread which requested
    the GIL drop now resets its request before exiting.
  - Fix a possible assertion failure, fatal error, or SystemError
    if a line tracing event raises an exception while opcode
    tracing is enabled.
  - Fix undefined behaviour in C code of null pointer arithmetic.
  - Do not expose KeyWrapper in _functools.
  - When loading a file with invalid UTF-8 inside a multi-line
    string, a correct SyntaxError is emitted.
  - Disable incorrect pickling of the C implemented classmethod
    descriptors.
  - Fix AttributeError missing name and obj attributes in       .
    object.__getattribute__() bpo-42316: Document some places   .
    where an assignment expression needs parentheses            .
  - Wrap network errors consistently in urllib FTP support, so
    the test suite doesn’t fail when a network is available but
    the public internet is not reachable.
  - Fixes AttributeError when subprocess.check_output() is used
    with argument input=None and either of the arguments encoding
    or errors are used.
  - Avoid spurious tracebacks from asyncio when default executor
    cleanup is delayed until after the event loop is closed (e.g.
    as the result of a keyboard interrupt).
  - Avoid a crash in the C version of
    asyncio.Future.remove_done_callback() when an evil argument
    is passed.
  - Remove tokenize.NL check from tabnanny.
  - Make Semaphore run faster.
  - Fix generation of the default name of
    tkinter.Checkbutton. Previously, checkbuttons in different
    parent widgets could have the same short name and share
    the same state if arguments “name” and “variable” are not
    specified. Now they are globally unique.
  - Update bundled libexpat to 2.4.9
  - Fix race condition in asyncio where process_exited() called
    before the pipe_data_received() leading to inconsistent
    output.
  - Fixed check in multiprocessing.resource_tracker that
    guarantees that the length of a write to a pipe is not
    greater than PIPE_BUF.
  - Corrected type annotation for dataclass attribute
    pstats.FunctionProfile.ncalls to be str.
  - Fix the faulthandler implementation of
    faulthandler.register(signal, chain=True) if the sigaction()
    function is not available: don’t call the previous signal
    handler if it’s NULL.
  - In inspect, fix overeager replacement of “typing.” in
    formatting annotations.
  - Fix asyncio.streams.StreamReaderProtocol to keep a strong
    reference to the created task, so that it’s not garbage
    collected
  - Fix handling compiler warnings (SyntaxWarning and
    DeprecationWarning) in codeop.compile_command() when checking
    for incomplete input. Previously it emitted warnings and
    raised a SyntaxError. Now it always returns None for
    incomplete input without emitting any warnings.
  - Fixed flickering of the turtle window when the tracer is
    turned off.
  - Allow asyncio.StreamWriter.drain() to be awaited concurrently
    by multiple tasks.
  - Fix broken asyncio.Semaphore when acquire is cancelled.
  - Fix ast.unparse() when ImportFrom.level is None
  - Improve performance of urllib.request.getproxies_environment
    when there are many environment variables
  - Fix ! in c domain ref target syntax via a conf.py patch, so
    it works as intended to disable ref target resolution.
  - Clarified the conflicting advice given in the ast
    documentation about ast.literal_eval() being “safe” for use
    on untrusted input while at the same time warning that it
    can crash the process. The latter statement is true and is
    deemed unfixable without a large amount of work unsuitable
    for a bugfix. So we keep the warning and no longer claim that
    literal_eval is safe.
  - Update tutorial introduction output to use 3.10+ SyntaxError
    invalid range.
- Remove upstreamed test-int-timing.patch.</changelog>
  <changelog author="mcepl@suse.com" date="1666353600">- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
  allow building of documentation with the latest Sphinx 5.3.0
  (gh#python/cpython#98366).</changelog>
  <changelog author="mcepl@suse.com" date="1667476800">- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
  CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
  privilege escalation via the multiprocessing forkserver start
  method.</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1670500800">- Update to 3.10.9:
  - python -m http.server no longer allows terminal
    control characters sent within a garbage request to be
    printed to the stderr server lo This is done by changing
    the http.server BaseHTTPRequestHandler .log_message method
    to replace control characters with a \xHH hex escape before
    printin
  - Avoid publishing list of active per-interpreter
    audit hooks via the gc module
  - The IDNA codec decoder used on DNS hostnames by
    socket or asyncio related name resolution functions no
    longer involves a quadratic algorithm. This prevents a
    potential CPU denial of service if an out-of-spec excessive
    length hostname involving bidirectional characters were
    decoded. Some protocols such as urllib http 3xx redirects
    potentially allow for an attacker to supply such a name.
  - Update bundled libexpat to 2.5.0
  - Port XKCP’s fix for the buffer overflows in SHA-3
    (CVE-2022-37454).
  - On Linux the multiprocessing module returns
    to using filesystem backed unix domain sockets for
    communication with the forkserver process instead of the
    Linux abstract socket namespace. Only code that chooses
    to use the “forkserver” start method is affected Abstract
    sockets have no permissions and could allow any user
    on the system in the same network namespace (often the
    whole system) to inject code into the multiprocessing
    forkserver process. This was a potential privilege
    escalation. Filesystem based socket permissions restrict
    this to the forkserver process user as was the default in
    Python 3.8 and earlier This prevents Linux CVE-2022-42919
  - Fix a reference bug in _imp.create_builtin()
    after the creation of the first sub-interpreter for modules
    builtins and sys. Patch by Victor Stinner.
  - Fixed a bug that was causing a buffer overflow if
    the tokenizer copies a line missing the newline caracter
    from a file that is as long as the available tokenizer
    buffer. Patch by Pablo galindo
  - Update faulthandler to emit an error message with
    the proper unexpected signal number. Patch by Dong-hee Na.
  - Fix subscription of types.GenericAlias instances
    containing bare generic types: for example tuple[A, T][int],
    where A is a generic type, and T is a type variable.
  - Fix detection of MAC addresses for uuid on certain
    OSs. Patch by Chaim Sanders
  - Print exception class name instead of its string
    representation when raising errors from ctypes calls.
  - Allow pdb to locate source for frozen modules in
    the standard library.
  - Raise ValueError instead of SystemError when
    methods of uninitialized io.IncrementalNewlineDecoder objects
    are called. Patch by Oren Milman.
  - Fix a possible assertion failure in io.FileIO when
    the opener returns an invalid file descriptor.
  - Also escape s in the http.server
    BaseHTTPRequestHandler.log_message so that it is technically
    possible to parse the line and reconstruct what the original
    data was. Without this a xHH is ambiguious as to if it is a
    hex replacement we put in or the characters r”x” came through
    in the original request line.
  - asyncio.get_event_loop() now only emits a
    deprecation warning when a new event loop was created
    implicitly. It no longer emits a deprecation warning if the
    current event loop was set.
  - Fix bug when calling trace.CoverageResults with
    valid infile.
  - Fix a bug in handling class cleanups in
    unittest.TestCase. Now addClassCleanup() uses separate lists
    for different TestCase subclasses, and doClassCleanups() only
    cleans up the particular class.
  - Release the GIL when calling termios APIs to avoid
    blocking threads.
  - Fix ast.increment_lineno() to also cover
    ast.TypeIgnore when changing line numbers.
  - Fixed bug where inspect.signature() reported
    incorrect arguments for decorated methods.
  - Fix SystemError in ctypes when exception was not
    set during __initsubclass__.
  - Fix statistics.NormalDist pickle with 0 and 1
    protocols.
  - Update the bundled copy of pip to version 22.3.1.
  - Apply bugfixes from importlib_metadata 4.11.4,
    namely: In PathDistribution._name_from_stem, avoid
    including parts of the extension in the result. In
    PathDistribution._normalized_name, ensure names loaded from
    the stem of the filename are also normalized, ensuring
    duplicate entry points by packages varying only by
    non-normalized name are hidden.
  - Clean up refleak on failed module initialisation in
    _zoneinfo
  - Clean up refleaks on failed module initialisation
    in in _pickle
  - Clean up refleak on failed module initialisation in
    _io.
  - Fix memory leak in math.dist() when both points
    don’t have the same dimension. Patch by Kumar Aditya.
  - Fix argument typechecks in _overlapped.WSAConnect()
    and _overlapped.Overlapped.WSASendTo() functions.
  - Fix internal error in the re module which in
    very rare circumstances prevented compilation of a regular
    expression containing a conditional expression without the
    “else” branch.
  - Fix asyncio.StreamWriter.drain() to call
    protocol.connection_lost callback only once on Windows.
  - Add a mutex to unittest.mock.NonCallableMock to
    protect concurrent access to mock attributes.
  - Fix hang on Windows in subprocess.wait_closed() in
    asyncio with ProactorEventLoop. Patch by Kumar Aditya.
  - Fix infinite loop in unittest when a
    self-referencing chained exception is raised
  - tkinter.Text.count() raises now an exception for
    options starting with “-” instead of silently ignoring them.
  - On uname_result, restored expectation that _fields
    and _asdict would include all six properties including
    processor.
  - Update the bundled copies of pip and setuptools to
    versions 22.3 and 65.5.0 respectively.
  - Fix bug in urllib.parse.urlparse() that causes
    certain port numbers containing whitespace, underscores,
    plus and minus signs, or non-ASCII digits to be incorrectly
    accepted.
  - Allow venv to pass along PYTHON* variables to
    ensurepip and pip when they do not impact path resolution
  - On macOS, fix a crash in syslog.syslog() in
    multi-threaded applications. On macOS, the libc syslog()
    function is not thread-safe, so syslog.syslog() no longer
    releases the GIL to call it. Patch by Victor Stinner.
  - Allow BUILTINS to be a valid field name for frozen
    dataclasses.
  - Make sure patch.dict() can be applied on async
    functions.
  - To avoid apparent memory leaks when
    asyncio.open_connection() raises, break reference cycles
    generated by local exception and future instances (which has
    exception instance as its member var). Patch by Dong Uk,
    Kang.
  - Prevent error when activating venv in nested fish
    instances.
  - Restrict use of sockets instead of pipes for stdin
    of subprocesses created by asyncio to AIX platform only.
  - shutil.copytree() now applies the
    ignore_dangling_symlinks argument recursively.
  - Fix IndexError in argparse.ArgumentParser when a
    store_true action is given an explicit argument.
  - Document that calling variadic functions with
    ctypes requires special care on macOS/arm64 (and possibly
    other platforms).
  - Skip test_normalization() of test_unicodedata
    if it fails to download NormalizationTest.txt file from
    pythontest.net. Patch by Victor Stinner.
  - Some C API tests were moved into the new
    Lib/test/test_capi/ directory.
  - Fix -Wimplicit-int, -Wstrict-prototypes, and
  - Wimplicit-function-declaration compiler warnings in
    configure checks.
  - Fix -Wimplicit-int compiler warning in configure
    check for PTHREAD_SCOPE_SYSTEM.
  - Specify the full path to the source location for
    make docclean (needed for cross-builds).
  - Fix NO_MISALIGNED_ACCESSES being not defined
    for the SHA3 extension when HAVE_ALIGNED_REQUIRED is
    set. Allowing builds on hardware that unaligned memory
    accesses are not allowed.
  - Fix handling of module docstrings in
    Tools/i18n/pygettext.py.
- Remove upstreamed patches:
  - 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
  - CVE-2015-20107-mailcap-unsafe-filenames.patch
  - CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
  - CVE-2022-45061-DoS-by-IDNA-decode.patch</changelog>
  <changelog author="kukuk@suse.com" date="1674820800">- Disable NIS for new products, it's deprecated and gets removed</changelog>
  <changelog author="mcepl@suse.com" date="1676980800">- Add provides for readline and sqlite3 to the main Python
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Update to 3.10.10:
  Bug fixes and regressions handling, no change of behaviour and
  no security bugs fixed.
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678708800">- Add invalid-json.patch fixing invalid JSON in
  Doc/howto/logging-cookbook.rst (somehow similar to
  gh#python/cpython#102582).</changelog>
  <changelog author="mcepl@suse.com" date="1682596800">- Update to 3.10.11:
  - Core and Builtins
  - gh-102416: Do not memoize incorrectly automatically
    generated loop rules in the parser. Patch by Pablo Galindo.
  - gh-102356: Fix a bug that caused a crash when deallocating
    deeply nested filter objects. Patch by Marta Gómez Macías.
  - gh-102397: Fix segfault from race condition in signal
    handling during garbage collection. Patch by Kumar Aditya.
  - gh-102126: Fix deadlock at shutdown when clearing thread
    states if any finalizer tries to acquire the runtime head
    lock. Patch by Kumar Aditya.
  - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
    module. Patch by Max Bachmann.
  - gh-101967: Fix possible segfault in
    positional_only_passed_as_keyword function, when new list
    created.
  - gh-101765: Fix SystemError / segmentation fault in iter
    __reduce__ when internal access of builtins.__dict__ keys
    mutates the iter object.
  - Library
  - gh-102947: Improve traceback when dataclasses.fields() is
    called on a non-dataclass. Patch by Alex Waygood
  - gh-101979: Fix a bug where parentheses in the metavar
    argument to argparse.ArgumentParser.add_argument() were
    dropped. Patch by Yeojin Kim.
  - gh-102179: Fix os.dup2() error message for negative fds.
  - gh-101961: For the binary mode, fileinput.hookcompressed()
    doesn’t set the encoding value even if the value is
    None. Patch by Gihwan Kim.
  - gh-101936: The default value of fp becomes io.BytesIO
    if HTTPError is initialized without a designated fp
    parameter. Patch by Long Vo.
  - gh-101566: In zipfile, apply fix for extractall on the
    underlying zipfile after being wrapped in Path.
  - gh-101997: Upgrade pip wheel bundled with ensurepip (pip
    23.0.1)
  - gh-101892: Callable iterators no longer raise SystemError
    when the callable object exhausts the iterator but forgets
    to either return a sentinel value or raise StopIteration.
  - gh-97786: Fix potential undefined behaviour in corner cases
    of floating-point-to-time conversions.
  - gh-101517: Fixed bug where bdb looks up the source line
    with linecache with a lineno=None, which causes it to fail
    with an unhandled exception.
  - gh-101673: Fix a pdb bug where ll clears the changes to
    local variables.
  - gh-96931: Fix incorrect results from
    ssl.SSLSocket.shared_ciphers()
  - gh-88233: Correctly preserve “extra” fields in zipfile
    regardless of their ordering relative to a zip64 “extra.”
  - gh-95495: When built against OpenSSL 3.0, the ssl module
    had a bug where it reported unauthenticated EOFs (i.e.
    without close_notify) as a clean TLS-level EOF. It now
    raises SSLEOFError, matching the behavior in previous
    versions of OpenSSL. The options attribute on SSLContext
    also no longer includes OP_IGNORE_UNEXPECTED_EOF by
    default. This option may be set to specify the previous
    OpenSSL 3.0 behavior.
  - gh-94440: Fix a concurrent.futures.process bug where
    ProcessPoolExecutor shutdown could hang after a future has
    been quickly submitted and canceled.
  - Documentation
  - gh-103112: Add docstring to http.client.HTTPResponse.read()
    to fix pydoc output.
  - gh-85417: Update cmath documentation to clarify behaviour
    on branch cuts.
  - gh-97725: Fix asyncio.Task.print_stack() description for
    file=None. Patch by Oleg Iarygin.
  - Tests
  - gh-102980: Improve test coverage on pdb.
  - gh-102537: Adjust the error handling strategy in
    test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
    Paul Ganssle.
  - gh-101377: Improved test_locale_calendar_formatweekday of
    calendar.
  - Build
  - gh-102711: Fix -Wstrict-prototypes compiler warnings.
- Removed upstreamed:
  - invalid-json.patch</changelog>
  <changelog author="mcepl@suse.com" date="1682596801">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
</package>
<package pkgid="1e3c526a8efa33fad88fec62e2f68c974c40e4d2777fc7a6152e46dd4f097ab9" name="rekor" arch="aarch64">
  <version epoch="0" ver="1.2.1" rel="150400.4.12.1"/>
  <changelog author="mrueckert@suse.de" date="1637928000">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1638964800">- prepare building of the serve part</changelog>
  <changelog author="meissner@suse.com" date="1641470400">- updated to 0.4.0
  Highlights
  - Adds hashed rekord type that can be used to upload signatures along with the hashed content signed (#501)</changelog>
  <changelog author="bwiedemann@suse.com" date="1643112000">- Fix BUILD_DATE for reproducible build results (boo#1047218)</changelog>
  <changelog author="meissner@suse.com" date="1643889600">- enable server build too, as people might want to deploy rekor chain
  themselves.</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- Updated to rekor 0.5.0
  * Highlights
  - Add Rekor logo to README (#650)
  - update API calls to v5 (#591)
  - Refactor helm type to remove intermediate state. (#575)
  - Refactor the shard map parsing so we can pass it down into the API object. (#564)
  - Refactor the alpine type to reduce intermediate state. (#573)
  * Enhancements
  - Add logic to GET artifacts via old or new UUID (#587)
  - helpful error message for hashedrekord types (#605)
  - Set Accept header in dynamic counter requests (#594)
  - Add sharding package and update validators (#583)
  - rekor-cli: show the url in case of error (#581)
  - Enable parsing of incomplete minisign keys, to enable re-indexing. (#567)
  - Cleanups on the TUF pluggable type. (#563)
  - Refactor the RPM type to remove more intermediate state. (#566)
  - Do some cleanups of the jar type to remove intermediate state. (#561)
  * Others
  - update version comments since dependabot doesn't do it (#617)
  - Use workload identity provider instead of GitHub Secret for GCR access (#600)
  - add OSSF scorecard action (#599)
  - enable the sbom for rekor releases (#586)
  - Point to the official website (instead of a 404) (#580)
  - Add a Makefile target for the "ko apply" step. (#572)
  - types/README.md: Corrected documentation link (#568)</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- Updated to rekor 0.6.0
  - attempting to fix codeowners file by @bobcallaway in #653
  - Update the warning text for the GA release. by @dlorenc in #654
  - Add docs about API stability and deprecation policy by @priyawadhwa in #661
  - update cross-build and dockerfile to use go 1.17.7 by @cpanato in #666
  - Move k8s objects out of the default namespace by @k4leung4 in #674
  - add securityContext to deployment. by @k4leung4 in #678
  - Add intoto type documentation by @jspeed-meyers in #679
  - create namespace for rekor config in yaml. by @k4leung4 in #680
  - Set rekor-cli User-Agent header on requests by @bobcallaway in #684
  - update security process link by @bobcallaway in #685
  - explicitly set permissions for github actions by @k4leung4 in #687
  - Add documentation about Alpine type by @jspeed-meyers in #697
  - Add code coverage to pull requests. by @k4leung4 in #676
  - Consistent parenthesis use in Makefile by @k4leung4 in #700
  - Use logRangesFlag in API, route reads based on TreeID by @lkatalin in #671
  - Generate release yaml for non-CI builds. by @k4leung4 in #702
  - Mirror signed release images from GCR to GHCR as part of release by @k4leung4 in #701
  - build trillian container to existing release. by @k4leung4 in #715
  - Make the loginfo command a bit more future/backwards proof. by @dlorenc in #718
  - Switch to using the swag library for pointer manipulation. by @dlorenc in #719
  - Change TreeID to be of type string instead of int64 by @priyawadhwa in #712
  - Add sharding e2e test to Github Actions by @priyawadhwa in #714
  - fix merge conflict by @priyawadhwa in #720
  - Clearer logging for createAndInitTree by @priyawadhwa in #724
  - Return virtual index when creating and getting a log entry by @priyawadhwa in #725
  - Fix copy/paste mistake in repo name. by @k4leung4 in #730
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #729
  - Get log proofs by Tree ID by @priyawadhwa in #733
  - Refactor rekor-cli loginfo by @priyawadhwa in #734
  - Update loginfo API endpoint to return information about inactive shards by @priyawadhwa in #738
  - Replace trillian_log_server.log_id_ranges flag with a config file by @priyawadhwa in #742
  - fix build date format for version command by @cpanato in #745
  - Require tlog_id when log_id_ranges is passed in by @lkatalin in #739
  - Use active tree on server startup by @lkatalin in #727
  - Specify public key for inactive shards in shard config by @priyawadhwa in #746
  - Add support for providing certificate chain for X509 signature types by @haydentherapper in #747
  - fix typo in filename by @bobcallaway in #758
  - Update release jobs and trillian images by @cpanato in #756
  - Add the SHA256 digest of the intoto payload into the rekor entry by @bobcallaway in #764
  - Add index to hashed intoto envelope by @asraa in #761
  - Fix link in types README by @eddiezane in #765
  - set p.Block after parsing in helm provenance type by @bobcallaway in #759
  - Fix search without sha prefix by @eddiezane in #767
  - Add in configmap to release for sharding config by @priyawadhwa in #766
  - Search inactive trees for GET by UUID requests by @lkatalin in #750
  - Create EntryID for new artifacts and return EntryID to user by @lkatalin in #623
  - Update cloudbuild to not fail when copy the images by @cpanato in #773</changelog>
  <changelog author="meissner@suse.com" date="1655726400">- Updated to rekor 0.8.1
  - Fix indexing bug for intoto attestations by @priyawadhwa in #870
  - Allow an expired certificate chain to be uploaded and verified by @haydentherapper in #873
- Updated to rekor 0.8.0
  - Update go-tuf and sigstore/sigstore to non-vulnerable go-tuf version. by @dhaus67 in #847
  - Configure rekor server in e2e tests via env variable by @priyawadhwa in #850
  - update cross-builder image to use go1.17.11 and dockerfile base image by @cpanato in #860
  - update go.mod to go1.17 by @cpanato in #861
  - Improve error message when using ED25519 with HashedRekord type by @haydentherapper in #862
  - Allow retrieving entryIDs or UUIDs via /api/v1/log/entries/retrieve endpoint by @priyawadhwa in #859
  - Print total tree size, including inactive shards in rekor-cli loginfo by @priyawadhwa in #864
- Updated to rekor 0.7.0
  - remove URL fetch of keys/artifacts server-side by @bobcallaway in #735
  - intoto: add index on materials digest of slsa provenance by @asraa in #793
  - chore(deps): Included dependency review by @naveensrinivasan in #788
  - Check if intoto hash is available before accessing it as an index key by @priyawadhwa in #800
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @asraa in #807
  - Retrieve shard tree length if it isn't provided in the config by @priyawadhwa in #810
  - update release builder images to use go 1.17.10 and cosign image to 1.8.0 by @cpanato in #820
  - update go to 1.17.10 in the dockerfile by @cpanato in #819
  - Limit the number of certificates parsed in a chain by @haydentherapper in #823
  - Breaking change: Remove timestamping authority by @haydentherapper in #813
  - Add back owners for rfc3161 package type by @haydentherapper in #833
  - all: remove dependency on deprecated github.com/pkg/errors by @zchee in #834
  - name stored attestations by digest instead of UUID by @bobcallaway in #769</changelog>
  <changelog author="meissner@suse.com" date="1656504000">- rekor-zypper-verify.sh: add a small script that verifies the on-system
  zypper repo cache against rekor transparency log.</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to rekor 0.9.1
  - feat: add subject URIs to index for x509 certificates by @asraa in #897
  - fix: sql syntax in dbcreate script by @xens in #903
  - Switch to go 1.18 and pin release-utils to v0.7.1 by @saschagrunert in #904
  - Check inactive shards for UUID for /retrieve endpoint by @priyawadhwa in #905
  - ensure log messages have requestID where possible by @bobcallaway in #907
  - Remove unnecessary lookup of non-existent attestations from storage layer by @bobcallaway in #909
  - Fix bug where /retrieve endpoint returns wrong logIndex across shards by @priyawadhwa in #908
- updated to rekor 0.9.0
  - Add COSE support to Rekor by @kommendorkapten in #867
  - Fix intoto index keys by @bobcallaway in #889
  - Resolve virtual log index when calling /retrieve endpoint by @priyawadhwa in #894
- updated to rekor 0.8.2
  - collect docker-compose logs if sharding tests fail, also trim IDs by @bobcallaway in #869
  - ensure fallback logic executes if attestation key is empty when fetching attestation by @bobcallaway in #878</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to rekor 0.12.0 (jsc#SLE-23476):
  - check supportedVersions list rather than directly reading from version map by @bobcallaway in #1003
  - enable blocking specific pluggable type versions from being inserted into the log by @bobcallaway in #1004
  - api.SearchLogQueryHandler thread safety by @cdris in #1006
  - 'docker compose' to 'docker-compose' by @bobcallaway in #1009
  - Intoto v0.0.2 by @pxp928 in #973
  - Add bounds on number of elements in api/v1/log/entries/retrieve by @priyawadhwa in #1011
  - Change Checkpoint origin to be "Hostname - Tree ID" by @haydentherapper in #1013
  - feat: add verification functions by @asraa in #986
  - Validate tree ID on calls to /api/v1/log/entries/retrieve by @priyawadhwa in #1017
  - Include checkpoint (STH) in entry upload and retrieve responses by @haydentherapper in #1015
  - fix: use entry uuid uniformly in return responses by @asraa in #1012
  - remove /api/v1/version endpoint by @bobcallaway in #1022
  - Fix rekor-cli backwards incompatibility &amp; run harness tests against HEAD by @priyawadhwa in #1030
  - Fix harness tests @ main by @priyawadhwa in #1038
  - Fetch all tags in harness tests by @priyawadhwa in #1039
  - fix retrieve endpoint response code and add testing by @asraa in #1043
- updated to rekor 0.11.0:
  - Add rekor harness tests by @priyawadhwa in #945
  - Persist and check attestations across harness tests by @priyawadhwa in #952
  - Add harness test for getting all entries by UUID and EntryID by @priyawadhwa in #957
  - api: fix inclusion proof verification flake by @asraa in #956
  - change default value for rekor_server.hostname to server's hostname by @bobcallaway in #963
  - fix nil-pointer error when artifact-hash is passed without artifact by @dsa0x in #965
  - Add prometheus summary to track metric latency by @priyawadhwa in #966
  - compute payload and envelope hashes upon validating intoto proposed entries by @bobcallaway in #967
  - update field documentation on publicKey for hashedrekord by @bobcallaway in #969
  - Allow sharding config to be written in yaml or json by @priyawadhwa in #974
  - fix incorrect schema id for cose type by @bobcallaway in #979
  - fix: make rekor verify work with sharded uuids by @asraa in #970
  - update builder and cosign images by @cpanato in #981
  - remove trailing slash on directories by @bobcallaway in #984
  - add support for intersection &amp; union in search operations by @dsa0x in #968
  - Update scorecard-action to v2:alpha by @azeemshaikh38 in #987
- updated to rekor 0.10.0:
  - reuse DSSE signature wrappers instead of a local copy by @bobcallaway in #912
  - Updates on the release job/makefile cleanup by @cpanato in #914
  - Return 404 if entry isn't found in log by @priyawadhwa in #915
  - Update cosign image in validate-release job by @priyawadhwa in #931
  - update go builder and cosign image by @cpanato in #934
  - Drop application/yaml content type by @haydentherapper in #933
  - Add rekor test harness to presubmit tests by @priyawadhwa in #921
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #941
  - update go mod in hack/tools to go1.18 by @cpanato in #935
  - add ldflags back by @cpanato in #944</changelog>
  <changelog author="meissner@suse.com" date="1664280000">- updated to rekor 0.12.1 (jsc#SLE-23476):
  - ** Rekor ** v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version
    The addition of the intotov2 created a breaking change for the rekor-cli
  - What's Changed
  - fix: fix harness tests with intoto v0.0.2 by @asraa in #1052
  - feat: add file based signer and password by @asraa in #1049
  - Adds new rekor metrics for latency and QPS. by @var-sdk in #1059</changelog>
  <changelog author="meissner@suse.com" date="1664539200">- updated to rekor 0.12.2 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint
  - Adding e2e test coverage
  - export rekor build/version information
  - Use POST instead of GET for /api/log/entries/retrieve metrics.
  - Search through all shards when searching by hash</changelog>
  <changelog author="meissner@suse.com" date="1666180800">- updated to rekor 1.0.0 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint by @bobcallaway in https://github.com/sigstore/rekor/pull/1073
  - Adding e2e test coverage by @cdris in https://github.com/sigstore/rekor/pull/1071
  - export rekor build/version information by @cpanato in https://github.com/sigstore/rekor/pull/1074
  - Use POST instead of GET for /api/log/entries/retrieve metrics. by @var-sdk in https://github.com/sigstore/rekor/pull/1083
  - Search through all shards when searching by hash by @priyawadhwa in https://github.com/sigstore/rekor/pull/1082
  - verify: verify checkpoint's STH against the inclusion proof root hash by @asraa in https://github.com/sigstore/rekor/pull/1092
  - add ability to enable/disable specific rekor API endpoints by @bobcallaway in https://github.com/sigstore/rekor/pull/1080
  - enable configurable client retries with backoff in RekorClient by @bobcallaway in https://github.com/sigstore/rekor/pull/1096
  - remove dead code around api-key and timestamp references by @bobcallaway in https://github.com/sigstore/rekor/pull/1098
  - update swagger API version to 1.0.0 by @bobcallaway in https://github.com/sigstore/rekor/pull/1102
  - remove unused RekorVersion API definition by @bobcallaway in https://github.com/sigstore/rekor/pull/1101
  - install gocovmerge in hack/tools by @bobcallaway in https://github.com/sigstore/rekor/pull/1103
  - add retry command line flag on rekor-cli by @bobcallaway in https://github.com/sigstore/rekor/pull/1097
  - Add some info and debug logging to commonly used funcs by @priyawadhwa in https://github.com/sigstore/rekor/pull/1106</changelog>
  <changelog author="meissner@suse.com" date="1669723200">- updated to rekor 1.0.1 (jsc#SLE-23476):
  - stop inserting envelope hash for intoto:0.0.2 types into index</changelog>
  <changelog author="meissner@suse.com" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="meissner@suse.com" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="meissner@suse.com" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
</package>
<package pkgid="5bdb73e0aa25c8fefe0c91cf39581f5135a5a799b05902f65d3777b864b47256" name="rekor" arch="ppc64le">
  <version epoch="0" ver="1.2.1" rel="150400.4.12.1"/>
  <changelog author="mrueckert@suse.de" date="1637928000">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1638964800">- prepare building of the serve part</changelog>
  <changelog author="meissner@suse.com" date="1641470400">- updated to 0.4.0
  Highlights
  - Adds hashed rekord type that can be used to upload signatures along with the hashed content signed (#501)</changelog>
  <changelog author="bwiedemann@suse.com" date="1643112000">- Fix BUILD_DATE for reproducible build results (boo#1047218)</changelog>
  <changelog author="meissner@suse.com" date="1643889600">- enable server build too, as people might want to deploy rekor chain
  themselves.</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- Updated to rekor 0.5.0
  * Highlights
  - Add Rekor logo to README (#650)
  - update API calls to v5 (#591)
  - Refactor helm type to remove intermediate state. (#575)
  - Refactor the shard map parsing so we can pass it down into the API object. (#564)
  - Refactor the alpine type to reduce intermediate state. (#573)
  * Enhancements
  - Add logic to GET artifacts via old or new UUID (#587)
  - helpful error message for hashedrekord types (#605)
  - Set Accept header in dynamic counter requests (#594)
  - Add sharding package and update validators (#583)
  - rekor-cli: show the url in case of error (#581)
  - Enable parsing of incomplete minisign keys, to enable re-indexing. (#567)
  - Cleanups on the TUF pluggable type. (#563)
  - Refactor the RPM type to remove more intermediate state. (#566)
  - Do some cleanups of the jar type to remove intermediate state. (#561)
  * Others
  - update version comments since dependabot doesn't do it (#617)
  - Use workload identity provider instead of GitHub Secret for GCR access (#600)
  - add OSSF scorecard action (#599)
  - enable the sbom for rekor releases (#586)
  - Point to the official website (instead of a 404) (#580)
  - Add a Makefile target for the "ko apply" step. (#572)
  - types/README.md: Corrected documentation link (#568)</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- Updated to rekor 0.6.0
  - attempting to fix codeowners file by @bobcallaway in #653
  - Update the warning text for the GA release. by @dlorenc in #654
  - Add docs about API stability and deprecation policy by @priyawadhwa in #661
  - update cross-build and dockerfile to use go 1.17.7 by @cpanato in #666
  - Move k8s objects out of the default namespace by @k4leung4 in #674
  - add securityContext to deployment. by @k4leung4 in #678
  - Add intoto type documentation by @jspeed-meyers in #679
  - create namespace for rekor config in yaml. by @k4leung4 in #680
  - Set rekor-cli User-Agent header on requests by @bobcallaway in #684
  - update security process link by @bobcallaway in #685
  - explicitly set permissions for github actions by @k4leung4 in #687
  - Add documentation about Alpine type by @jspeed-meyers in #697
  - Add code coverage to pull requests. by @k4leung4 in #676
  - Consistent parenthesis use in Makefile by @k4leung4 in #700
  - Use logRangesFlag in API, route reads based on TreeID by @lkatalin in #671
  - Generate release yaml for non-CI builds. by @k4leung4 in #702
  - Mirror signed release images from GCR to GHCR as part of release by @k4leung4 in #701
  - build trillian container to existing release. by @k4leung4 in #715
  - Make the loginfo command a bit more future/backwards proof. by @dlorenc in #718
  - Switch to using the swag library for pointer manipulation. by @dlorenc in #719
  - Change TreeID to be of type string instead of int64 by @priyawadhwa in #712
  - Add sharding e2e test to Github Actions by @priyawadhwa in #714
  - fix merge conflict by @priyawadhwa in #720
  - Clearer logging for createAndInitTree by @priyawadhwa in #724
  - Return virtual index when creating and getting a log entry by @priyawadhwa in #725
  - Fix copy/paste mistake in repo name. by @k4leung4 in #730
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #729
  - Get log proofs by Tree ID by @priyawadhwa in #733
  - Refactor rekor-cli loginfo by @priyawadhwa in #734
  - Update loginfo API endpoint to return information about inactive shards by @priyawadhwa in #738
  - Replace trillian_log_server.log_id_ranges flag with a config file by @priyawadhwa in #742
  - fix build date format for version command by @cpanato in #745
  - Require tlog_id when log_id_ranges is passed in by @lkatalin in #739
  - Use active tree on server startup by @lkatalin in #727
  - Specify public key for inactive shards in shard config by @priyawadhwa in #746
  - Add support for providing certificate chain for X509 signature types by @haydentherapper in #747
  - fix typo in filename by @bobcallaway in #758
  - Update release jobs and trillian images by @cpanato in #756
  - Add the SHA256 digest of the intoto payload into the rekor entry by @bobcallaway in #764
  - Add index to hashed intoto envelope by @asraa in #761
  - Fix link in types README by @eddiezane in #765
  - set p.Block after parsing in helm provenance type by @bobcallaway in #759
  - Fix search without sha prefix by @eddiezane in #767
  - Add in configmap to release for sharding config by @priyawadhwa in #766
  - Search inactive trees for GET by UUID requests by @lkatalin in #750
  - Create EntryID for new artifacts and return EntryID to user by @lkatalin in #623
  - Update cloudbuild to not fail when copy the images by @cpanato in #773</changelog>
  <changelog author="meissner@suse.com" date="1655726400">- Updated to rekor 0.8.1
  - Fix indexing bug for intoto attestations by @priyawadhwa in #870
  - Allow an expired certificate chain to be uploaded and verified by @haydentherapper in #873
- Updated to rekor 0.8.0
  - Update go-tuf and sigstore/sigstore to non-vulnerable go-tuf version. by @dhaus67 in #847
  - Configure rekor server in e2e tests via env variable by @priyawadhwa in #850
  - update cross-builder image to use go1.17.11 and dockerfile base image by @cpanato in #860
  - update go.mod to go1.17 by @cpanato in #861
  - Improve error message when using ED25519 with HashedRekord type by @haydentherapper in #862
  - Allow retrieving entryIDs or UUIDs via /api/v1/log/entries/retrieve endpoint by @priyawadhwa in #859
  - Print total tree size, including inactive shards in rekor-cli loginfo by @priyawadhwa in #864
- Updated to rekor 0.7.0
  - remove URL fetch of keys/artifacts server-side by @bobcallaway in #735
  - intoto: add index on materials digest of slsa provenance by @asraa in #793
  - chore(deps): Included dependency review by @naveensrinivasan in #788
  - Check if intoto hash is available before accessing it as an index key by @priyawadhwa in #800
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @asraa in #807
  - Retrieve shard tree length if it isn't provided in the config by @priyawadhwa in #810
  - update release builder images to use go 1.17.10 and cosign image to 1.8.0 by @cpanato in #820
  - update go to 1.17.10 in the dockerfile by @cpanato in #819
  - Limit the number of certificates parsed in a chain by @haydentherapper in #823
  - Breaking change: Remove timestamping authority by @haydentherapper in #813
  - Add back owners for rfc3161 package type by @haydentherapper in #833
  - all: remove dependency on deprecated github.com/pkg/errors by @zchee in #834
  - name stored attestations by digest instead of UUID by @bobcallaway in #769</changelog>
  <changelog author="meissner@suse.com" date="1656504000">- rekor-zypper-verify.sh: add a small script that verifies the on-system
  zypper repo cache against rekor transparency log.</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to rekor 0.9.1
  - feat: add subject URIs to index for x509 certificates by @asraa in #897
  - fix: sql syntax in dbcreate script by @xens in #903
  - Switch to go 1.18 and pin release-utils to v0.7.1 by @saschagrunert in #904
  - Check inactive shards for UUID for /retrieve endpoint by @priyawadhwa in #905
  - ensure log messages have requestID where possible by @bobcallaway in #907
  - Remove unnecessary lookup of non-existent attestations from storage layer by @bobcallaway in #909
  - Fix bug where /retrieve endpoint returns wrong logIndex across shards by @priyawadhwa in #908
- updated to rekor 0.9.0
  - Add COSE support to Rekor by @kommendorkapten in #867
  - Fix intoto index keys by @bobcallaway in #889
  - Resolve virtual log index when calling /retrieve endpoint by @priyawadhwa in #894
- updated to rekor 0.8.2
  - collect docker-compose logs if sharding tests fail, also trim IDs by @bobcallaway in #869
  - ensure fallback logic executes if attestation key is empty when fetching attestation by @bobcallaway in #878</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to rekor 0.12.0 (jsc#SLE-23476):
  - check supportedVersions list rather than directly reading from version map by @bobcallaway in #1003
  - enable blocking specific pluggable type versions from being inserted into the log by @bobcallaway in #1004
  - api.SearchLogQueryHandler thread safety by @cdris in #1006
  - 'docker compose' to 'docker-compose' by @bobcallaway in #1009
  - Intoto v0.0.2 by @pxp928 in #973
  - Add bounds on number of elements in api/v1/log/entries/retrieve by @priyawadhwa in #1011
  - Change Checkpoint origin to be "Hostname - Tree ID" by @haydentherapper in #1013
  - feat: add verification functions by @asraa in #986
  - Validate tree ID on calls to /api/v1/log/entries/retrieve by @priyawadhwa in #1017
  - Include checkpoint (STH) in entry upload and retrieve responses by @haydentherapper in #1015
  - fix: use entry uuid uniformly in return responses by @asraa in #1012
  - remove /api/v1/version endpoint by @bobcallaway in #1022
  - Fix rekor-cli backwards incompatibility &amp; run harness tests against HEAD by @priyawadhwa in #1030
  - Fix harness tests @ main by @priyawadhwa in #1038
  - Fetch all tags in harness tests by @priyawadhwa in #1039
  - fix retrieve endpoint response code and add testing by @asraa in #1043
- updated to rekor 0.11.0:
  - Add rekor harness tests by @priyawadhwa in #945
  - Persist and check attestations across harness tests by @priyawadhwa in #952
  - Add harness test for getting all entries by UUID and EntryID by @priyawadhwa in #957
  - api: fix inclusion proof verification flake by @asraa in #956
  - change default value for rekor_server.hostname to server's hostname by @bobcallaway in #963
  - fix nil-pointer error when artifact-hash is passed without artifact by @dsa0x in #965
  - Add prometheus summary to track metric latency by @priyawadhwa in #966
  - compute payload and envelope hashes upon validating intoto proposed entries by @bobcallaway in #967
  - update field documentation on publicKey for hashedrekord by @bobcallaway in #969
  - Allow sharding config to be written in yaml or json by @priyawadhwa in #974
  - fix incorrect schema id for cose type by @bobcallaway in #979
  - fix: make rekor verify work with sharded uuids by @asraa in #970
  - update builder and cosign images by @cpanato in #981
  - remove trailing slash on directories by @bobcallaway in #984
  - add support for intersection &amp; union in search operations by @dsa0x in #968
  - Update scorecard-action to v2:alpha by @azeemshaikh38 in #987
- updated to rekor 0.10.0:
  - reuse DSSE signature wrappers instead of a local copy by @bobcallaway in #912
  - Updates on the release job/makefile cleanup by @cpanato in #914
  - Return 404 if entry isn't found in log by @priyawadhwa in #915
  - Update cosign image in validate-release job by @priyawadhwa in #931
  - update go builder and cosign image by @cpanato in #934
  - Drop application/yaml content type by @haydentherapper in #933
  - Add rekor test harness to presubmit tests by @priyawadhwa in #921
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #941
  - update go mod in hack/tools to go1.18 by @cpanato in #935
  - add ldflags back by @cpanato in #944</changelog>
  <changelog author="meissner@suse.com" date="1664280000">- updated to rekor 0.12.1 (jsc#SLE-23476):
  - ** Rekor ** v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version
    The addition of the intotov2 created a breaking change for the rekor-cli
  - What's Changed
  - fix: fix harness tests with intoto v0.0.2 by @asraa in #1052
  - feat: add file based signer and password by @asraa in #1049
  - Adds new rekor metrics for latency and QPS. by @var-sdk in #1059</changelog>
  <changelog author="meissner@suse.com" date="1664539200">- updated to rekor 0.12.2 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint
  - Adding e2e test coverage
  - export rekor build/version information
  - Use POST instead of GET for /api/log/entries/retrieve metrics.
  - Search through all shards when searching by hash</changelog>
  <changelog author="meissner@suse.com" date="1666180800">- updated to rekor 1.0.0 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint by @bobcallaway in https://github.com/sigstore/rekor/pull/1073
  - Adding e2e test coverage by @cdris in https://github.com/sigstore/rekor/pull/1071
  - export rekor build/version information by @cpanato in https://github.com/sigstore/rekor/pull/1074
  - Use POST instead of GET for /api/log/entries/retrieve metrics. by @var-sdk in https://github.com/sigstore/rekor/pull/1083
  - Search through all shards when searching by hash by @priyawadhwa in https://github.com/sigstore/rekor/pull/1082
  - verify: verify checkpoint's STH against the inclusion proof root hash by @asraa in https://github.com/sigstore/rekor/pull/1092
  - add ability to enable/disable specific rekor API endpoints by @bobcallaway in https://github.com/sigstore/rekor/pull/1080
  - enable configurable client retries with backoff in RekorClient by @bobcallaway in https://github.com/sigstore/rekor/pull/1096
  - remove dead code around api-key and timestamp references by @bobcallaway in https://github.com/sigstore/rekor/pull/1098
  - update swagger API version to 1.0.0 by @bobcallaway in https://github.com/sigstore/rekor/pull/1102
  - remove unused RekorVersion API definition by @bobcallaway in https://github.com/sigstore/rekor/pull/1101
  - install gocovmerge in hack/tools by @bobcallaway in https://github.com/sigstore/rekor/pull/1103
  - add retry command line flag on rekor-cli by @bobcallaway in https://github.com/sigstore/rekor/pull/1097
  - Add some info and debug logging to commonly used funcs by @priyawadhwa in https://github.com/sigstore/rekor/pull/1106</changelog>
  <changelog author="meissner@suse.com" date="1669723200">- updated to rekor 1.0.1 (jsc#SLE-23476):
  - stop inserting envelope hash for intoto:0.0.2 types into index</changelog>
  <changelog author="meissner@suse.com" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="meissner@suse.com" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="meissner@suse.com" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
</package>
<package pkgid="301ca2874a51eb3f0f467816b2c1e3e8444a55584560b95932ba2e4785225d53" name="rekor" arch="s390x">
  <version epoch="0" ver="1.2.1" rel="150400.4.12.1"/>
  <changelog author="mrueckert@suse.de" date="1637928000">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1638964800">- prepare building of the serve part</changelog>
  <changelog author="meissner@suse.com" date="1641470400">- updated to 0.4.0
  Highlights
  - Adds hashed rekord type that can be used to upload signatures along with the hashed content signed (#501)</changelog>
  <changelog author="bwiedemann@suse.com" date="1643112000">- Fix BUILD_DATE for reproducible build results (boo#1047218)</changelog>
  <changelog author="meissner@suse.com" date="1643889600">- enable server build too, as people might want to deploy rekor chain
  themselves.</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- Updated to rekor 0.5.0
  * Highlights
  - Add Rekor logo to README (#650)
  - update API calls to v5 (#591)
  - Refactor helm type to remove intermediate state. (#575)
  - Refactor the shard map parsing so we can pass it down into the API object. (#564)
  - Refactor the alpine type to reduce intermediate state. (#573)
  * Enhancements
  - Add logic to GET artifacts via old or new UUID (#587)
  - helpful error message for hashedrekord types (#605)
  - Set Accept header in dynamic counter requests (#594)
  - Add sharding package and update validators (#583)
  - rekor-cli: show the url in case of error (#581)
  - Enable parsing of incomplete minisign keys, to enable re-indexing. (#567)
  - Cleanups on the TUF pluggable type. (#563)
  - Refactor the RPM type to remove more intermediate state. (#566)
  - Do some cleanups of the jar type to remove intermediate state. (#561)
  * Others
  - update version comments since dependabot doesn't do it (#617)
  - Use workload identity provider instead of GitHub Secret for GCR access (#600)
  - add OSSF scorecard action (#599)
  - enable the sbom for rekor releases (#586)
  - Point to the official website (instead of a 404) (#580)
  - Add a Makefile target for the "ko apply" step. (#572)
  - types/README.md: Corrected documentation link (#568)</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- Updated to rekor 0.6.0
  - attempting to fix codeowners file by @bobcallaway in #653
  - Update the warning text for the GA release. by @dlorenc in #654
  - Add docs about API stability and deprecation policy by @priyawadhwa in #661
  - update cross-build and dockerfile to use go 1.17.7 by @cpanato in #666
  - Move k8s objects out of the default namespace by @k4leung4 in #674
  - add securityContext to deployment. by @k4leung4 in #678
  - Add intoto type documentation by @jspeed-meyers in #679
  - create namespace for rekor config in yaml. by @k4leung4 in #680
  - Set rekor-cli User-Agent header on requests by @bobcallaway in #684
  - update security process link by @bobcallaway in #685
  - explicitly set permissions for github actions by @k4leung4 in #687
  - Add documentation about Alpine type by @jspeed-meyers in #697
  - Add code coverage to pull requests. by @k4leung4 in #676
  - Consistent parenthesis use in Makefile by @k4leung4 in #700
  - Use logRangesFlag in API, route reads based on TreeID by @lkatalin in #671
  - Generate release yaml for non-CI builds. by @k4leung4 in #702
  - Mirror signed release images from GCR to GHCR as part of release by @k4leung4 in #701
  - build trillian container to existing release. by @k4leung4 in #715
  - Make the loginfo command a bit more future/backwards proof. by @dlorenc in #718
  - Switch to using the swag library for pointer manipulation. by @dlorenc in #719
  - Change TreeID to be of type string instead of int64 by @priyawadhwa in #712
  - Add sharding e2e test to Github Actions by @priyawadhwa in #714
  - fix merge conflict by @priyawadhwa in #720
  - Clearer logging for createAndInitTree by @priyawadhwa in #724
  - Return virtual index when creating and getting a log entry by @priyawadhwa in #725
  - Fix copy/paste mistake in repo name. by @k4leung4 in #730
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #729
  - Get log proofs by Tree ID by @priyawadhwa in #733
  - Refactor rekor-cli loginfo by @priyawadhwa in #734
  - Update loginfo API endpoint to return information about inactive shards by @priyawadhwa in #738
  - Replace trillian_log_server.log_id_ranges flag with a config file by @priyawadhwa in #742
  - fix build date format for version command by @cpanato in #745
  - Require tlog_id when log_id_ranges is passed in by @lkatalin in #739
  - Use active tree on server startup by @lkatalin in #727
  - Specify public key for inactive shards in shard config by @priyawadhwa in #746
  - Add support for providing certificate chain for X509 signature types by @haydentherapper in #747
  - fix typo in filename by @bobcallaway in #758
  - Update release jobs and trillian images by @cpanato in #756
  - Add the SHA256 digest of the intoto payload into the rekor entry by @bobcallaway in #764
  - Add index to hashed intoto envelope by @asraa in #761
  - Fix link in types README by @eddiezane in #765
  - set p.Block after parsing in helm provenance type by @bobcallaway in #759
  - Fix search without sha prefix by @eddiezane in #767
  - Add in configmap to release for sharding config by @priyawadhwa in #766
  - Search inactive trees for GET by UUID requests by @lkatalin in #750
  - Create EntryID for new artifacts and return EntryID to user by @lkatalin in #623
  - Update cloudbuild to not fail when copy the images by @cpanato in #773</changelog>
  <changelog author="meissner@suse.com" date="1655726400">- Updated to rekor 0.8.1
  - Fix indexing bug for intoto attestations by @priyawadhwa in #870
  - Allow an expired certificate chain to be uploaded and verified by @haydentherapper in #873
- Updated to rekor 0.8.0
  - Update go-tuf and sigstore/sigstore to non-vulnerable go-tuf version. by @dhaus67 in #847
  - Configure rekor server in e2e tests via env variable by @priyawadhwa in #850
  - update cross-builder image to use go1.17.11 and dockerfile base image by @cpanato in #860
  - update go.mod to go1.17 by @cpanato in #861
  - Improve error message when using ED25519 with HashedRekord type by @haydentherapper in #862
  - Allow retrieving entryIDs or UUIDs via /api/v1/log/entries/retrieve endpoint by @priyawadhwa in #859
  - Print total tree size, including inactive shards in rekor-cli loginfo by @priyawadhwa in #864
- Updated to rekor 0.7.0
  - remove URL fetch of keys/artifacts server-side by @bobcallaway in #735
  - intoto: add index on materials digest of slsa provenance by @asraa in #793
  - chore(deps): Included dependency review by @naveensrinivasan in #788
  - Check if intoto hash is available before accessing it as an index key by @priyawadhwa in #800
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @asraa in #807
  - Retrieve shard tree length if it isn't provided in the config by @priyawadhwa in #810
  - update release builder images to use go 1.17.10 and cosign image to 1.8.0 by @cpanato in #820
  - update go to 1.17.10 in the dockerfile by @cpanato in #819
  - Limit the number of certificates parsed in a chain by @haydentherapper in #823
  - Breaking change: Remove timestamping authority by @haydentherapper in #813
  - Add back owners for rfc3161 package type by @haydentherapper in #833
  - all: remove dependency on deprecated github.com/pkg/errors by @zchee in #834
  - name stored attestations by digest instead of UUID by @bobcallaway in #769</changelog>
  <changelog author="meissner@suse.com" date="1656504000">- rekor-zypper-verify.sh: add a small script that verifies the on-system
  zypper repo cache against rekor transparency log.</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to rekor 0.9.1
  - feat: add subject URIs to index for x509 certificates by @asraa in #897
  - fix: sql syntax in dbcreate script by @xens in #903
  - Switch to go 1.18 and pin release-utils to v0.7.1 by @saschagrunert in #904
  - Check inactive shards for UUID for /retrieve endpoint by @priyawadhwa in #905
  - ensure log messages have requestID where possible by @bobcallaway in #907
  - Remove unnecessary lookup of non-existent attestations from storage layer by @bobcallaway in #909
  - Fix bug where /retrieve endpoint returns wrong logIndex across shards by @priyawadhwa in #908
- updated to rekor 0.9.0
  - Add COSE support to Rekor by @kommendorkapten in #867
  - Fix intoto index keys by @bobcallaway in #889
  - Resolve virtual log index when calling /retrieve endpoint by @priyawadhwa in #894
- updated to rekor 0.8.2
  - collect docker-compose logs if sharding tests fail, also trim IDs by @bobcallaway in #869
  - ensure fallback logic executes if attestation key is empty when fetching attestation by @bobcallaway in #878</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to rekor 0.12.0 (jsc#SLE-23476):
  - check supportedVersions list rather than directly reading from version map by @bobcallaway in #1003
  - enable blocking specific pluggable type versions from being inserted into the log by @bobcallaway in #1004
  - api.SearchLogQueryHandler thread safety by @cdris in #1006
  - 'docker compose' to 'docker-compose' by @bobcallaway in #1009
  - Intoto v0.0.2 by @pxp928 in #973
  - Add bounds on number of elements in api/v1/log/entries/retrieve by @priyawadhwa in #1011
  - Change Checkpoint origin to be "Hostname - Tree ID" by @haydentherapper in #1013
  - feat: add verification functions by @asraa in #986
  - Validate tree ID on calls to /api/v1/log/entries/retrieve by @priyawadhwa in #1017
  - Include checkpoint (STH) in entry upload and retrieve responses by @haydentherapper in #1015
  - fix: use entry uuid uniformly in return responses by @asraa in #1012
  - remove /api/v1/version endpoint by @bobcallaway in #1022
  - Fix rekor-cli backwards incompatibility &amp; run harness tests against HEAD by @priyawadhwa in #1030
  - Fix harness tests @ main by @priyawadhwa in #1038
  - Fetch all tags in harness tests by @priyawadhwa in #1039
  - fix retrieve endpoint response code and add testing by @asraa in #1043
- updated to rekor 0.11.0:
  - Add rekor harness tests by @priyawadhwa in #945
  - Persist and check attestations across harness tests by @priyawadhwa in #952
  - Add harness test for getting all entries by UUID and EntryID by @priyawadhwa in #957
  - api: fix inclusion proof verification flake by @asraa in #956
  - change default value for rekor_server.hostname to server's hostname by @bobcallaway in #963
  - fix nil-pointer error when artifact-hash is passed without artifact by @dsa0x in #965
  - Add prometheus summary to track metric latency by @priyawadhwa in #966
  - compute payload and envelope hashes upon validating intoto proposed entries by @bobcallaway in #967
  - update field documentation on publicKey for hashedrekord by @bobcallaway in #969
  - Allow sharding config to be written in yaml or json by @priyawadhwa in #974
  - fix incorrect schema id for cose type by @bobcallaway in #979
  - fix: make rekor verify work with sharded uuids by @asraa in #970
  - update builder and cosign images by @cpanato in #981
  - remove trailing slash on directories by @bobcallaway in #984
  - add support for intersection &amp; union in search operations by @dsa0x in #968
  - Update scorecard-action to v2:alpha by @azeemshaikh38 in #987
- updated to rekor 0.10.0:
  - reuse DSSE signature wrappers instead of a local copy by @bobcallaway in #912
  - Updates on the release job/makefile cleanup by @cpanato in #914
  - Return 404 if entry isn't found in log by @priyawadhwa in #915
  - Update cosign image in validate-release job by @priyawadhwa in #931
  - update go builder and cosign image by @cpanato in #934
  - Drop application/yaml content type by @haydentherapper in #933
  - Add rekor test harness to presubmit tests by @priyawadhwa in #921
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #941
  - update go mod in hack/tools to go1.18 by @cpanato in #935
  - add ldflags back by @cpanato in #944</changelog>
  <changelog author="meissner@suse.com" date="1664280000">- updated to rekor 0.12.1 (jsc#SLE-23476):
  - ** Rekor ** v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version
    The addition of the intotov2 created a breaking change for the rekor-cli
  - What's Changed
  - fix: fix harness tests with intoto v0.0.2 by @asraa in #1052
  - feat: add file based signer and password by @asraa in #1049
  - Adds new rekor metrics for latency and QPS. by @var-sdk in #1059</changelog>
  <changelog author="meissner@suse.com" date="1664539200">- updated to rekor 0.12.2 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint
  - Adding e2e test coverage
  - export rekor build/version information
  - Use POST instead of GET for /api/log/entries/retrieve metrics.
  - Search through all shards when searching by hash</changelog>
  <changelog author="meissner@suse.com" date="1666180800">- updated to rekor 1.0.0 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint by @bobcallaway in https://github.com/sigstore/rekor/pull/1073
  - Adding e2e test coverage by @cdris in https://github.com/sigstore/rekor/pull/1071
  - export rekor build/version information by @cpanato in https://github.com/sigstore/rekor/pull/1074
  - Use POST instead of GET for /api/log/entries/retrieve metrics. by @var-sdk in https://github.com/sigstore/rekor/pull/1083
  - Search through all shards when searching by hash by @priyawadhwa in https://github.com/sigstore/rekor/pull/1082
  - verify: verify checkpoint's STH against the inclusion proof root hash by @asraa in https://github.com/sigstore/rekor/pull/1092
  - add ability to enable/disable specific rekor API endpoints by @bobcallaway in https://github.com/sigstore/rekor/pull/1080
  - enable configurable client retries with backoff in RekorClient by @bobcallaway in https://github.com/sigstore/rekor/pull/1096
  - remove dead code around api-key and timestamp references by @bobcallaway in https://github.com/sigstore/rekor/pull/1098
  - update swagger API version to 1.0.0 by @bobcallaway in https://github.com/sigstore/rekor/pull/1102
  - remove unused RekorVersion API definition by @bobcallaway in https://github.com/sigstore/rekor/pull/1101
  - install gocovmerge in hack/tools by @bobcallaway in https://github.com/sigstore/rekor/pull/1103
  - add retry command line flag on rekor-cli by @bobcallaway in https://github.com/sigstore/rekor/pull/1097
  - Add some info and debug logging to commonly used funcs by @priyawadhwa in https://github.com/sigstore/rekor/pull/1106</changelog>
  <changelog author="meissner@suse.com" date="1669723200">- updated to rekor 1.0.1 (jsc#SLE-23476):
  - stop inserting envelope hash for intoto:0.0.2 types into index</changelog>
  <changelog author="meissner@suse.com" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="meissner@suse.com" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="meissner@suse.com" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
</package>
<package pkgid="9fb7c3ff83361bd311be048aa90b7e8f35749a45105574789f984d37007c3ddf" name="rekor" arch="src">
  <version epoch="0" ver="1.2.1" rel="150400.4.12.1"/>
  <changelog author="mrueckert@suse.de" date="1637928000">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1638964800">- prepare building of the serve part</changelog>
  <changelog author="meissner@suse.com" date="1641470400">- updated to 0.4.0
  Highlights
  - Adds hashed rekord type that can be used to upload signatures along with the hashed content signed (#501)</changelog>
  <changelog author="bwiedemann@suse.com" date="1643112000">- Fix BUILD_DATE for reproducible build results (boo#1047218)</changelog>
  <changelog author="meissner@suse.com" date="1643889600">- enable server build too, as people might want to deploy rekor chain
  themselves.</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- Updated to rekor 0.5.0
  * Highlights
  - Add Rekor logo to README (#650)
  - update API calls to v5 (#591)
  - Refactor helm type to remove intermediate state. (#575)
  - Refactor the shard map parsing so we can pass it down into the API object. (#564)
  - Refactor the alpine type to reduce intermediate state. (#573)
  * Enhancements
  - Add logic to GET artifacts via old or new UUID (#587)
  - helpful error message for hashedrekord types (#605)
  - Set Accept header in dynamic counter requests (#594)
  - Add sharding package and update validators (#583)
  - rekor-cli: show the url in case of error (#581)
  - Enable parsing of incomplete minisign keys, to enable re-indexing. (#567)
  - Cleanups on the TUF pluggable type. (#563)
  - Refactor the RPM type to remove more intermediate state. (#566)
  - Do some cleanups of the jar type to remove intermediate state. (#561)
  * Others
  - update version comments since dependabot doesn't do it (#617)
  - Use workload identity provider instead of GitHub Secret for GCR access (#600)
  - add OSSF scorecard action (#599)
  - enable the sbom for rekor releases (#586)
  - Point to the official website (instead of a 404) (#580)
  - Add a Makefile target for the "ko apply" step. (#572)
  - types/README.md: Corrected documentation link (#568)</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- Updated to rekor 0.6.0
  - attempting to fix codeowners file by @bobcallaway in #653
  - Update the warning text for the GA release. by @dlorenc in #654
  - Add docs about API stability and deprecation policy by @priyawadhwa in #661
  - update cross-build and dockerfile to use go 1.17.7 by @cpanato in #666
  - Move k8s objects out of the default namespace by @k4leung4 in #674
  - add securityContext to deployment. by @k4leung4 in #678
  - Add intoto type documentation by @jspeed-meyers in #679
  - create namespace for rekor config in yaml. by @k4leung4 in #680
  - Set rekor-cli User-Agent header on requests by @bobcallaway in #684
  - update security process link by @bobcallaway in #685
  - explicitly set permissions for github actions by @k4leung4 in #687
  - Add documentation about Alpine type by @jspeed-meyers in #697
  - Add code coverage to pull requests. by @k4leung4 in #676
  - Consistent parenthesis use in Makefile by @k4leung4 in #700
  - Use logRangesFlag in API, route reads based on TreeID by @lkatalin in #671
  - Generate release yaml for non-CI builds. by @k4leung4 in #702
  - Mirror signed release images from GCR to GHCR as part of release by @k4leung4 in #701
  - build trillian container to existing release. by @k4leung4 in #715
  - Make the loginfo command a bit more future/backwards proof. by @dlorenc in #718
  - Switch to using the swag library for pointer manipulation. by @dlorenc in #719
  - Change TreeID to be of type string instead of int64 by @priyawadhwa in #712
  - Add sharding e2e test to Github Actions by @priyawadhwa in #714
  - fix merge conflict by @priyawadhwa in #720
  - Clearer logging for createAndInitTree by @priyawadhwa in #724
  - Return virtual index when creating and getting a log entry by @priyawadhwa in #725
  - Fix copy/paste mistake in repo name. by @k4leung4 in #730
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #729
  - Get log proofs by Tree ID by @priyawadhwa in #733
  - Refactor rekor-cli loginfo by @priyawadhwa in #734
  - Update loginfo API endpoint to return information about inactive shards by @priyawadhwa in #738
  - Replace trillian_log_server.log_id_ranges flag with a config file by @priyawadhwa in #742
  - fix build date format for version command by @cpanato in #745
  - Require tlog_id when log_id_ranges is passed in by @lkatalin in #739
  - Use active tree on server startup by @lkatalin in #727
  - Specify public key for inactive shards in shard config by @priyawadhwa in #746
  - Add support for providing certificate chain for X509 signature types by @haydentherapper in #747
  - fix typo in filename by @bobcallaway in #758
  - Update release jobs and trillian images by @cpanato in #756
  - Add the SHA256 digest of the intoto payload into the rekor entry by @bobcallaway in #764
  - Add index to hashed intoto envelope by @asraa in #761
  - Fix link in types README by @eddiezane in #765
  - set p.Block after parsing in helm provenance type by @bobcallaway in #759
  - Fix search without sha prefix by @eddiezane in #767
  - Add in configmap to release for sharding config by @priyawadhwa in #766
  - Search inactive trees for GET by UUID requests by @lkatalin in #750
  - Create EntryID for new artifacts and return EntryID to user by @lkatalin in #623
  - Update cloudbuild to not fail when copy the images by @cpanato in #773</changelog>
  <changelog author="meissner@suse.com" date="1655726400">- Updated to rekor 0.8.1
  - Fix indexing bug for intoto attestations by @priyawadhwa in #870
  - Allow an expired certificate chain to be uploaded and verified by @haydentherapper in #873
- Updated to rekor 0.8.0
  - Update go-tuf and sigstore/sigstore to non-vulnerable go-tuf version. by @dhaus67 in #847
  - Configure rekor server in e2e tests via env variable by @priyawadhwa in #850
  - update cross-builder image to use go1.17.11 and dockerfile base image by @cpanato in #860
  - update go.mod to go1.17 by @cpanato in #861
  - Improve error message when using ED25519 with HashedRekord type by @haydentherapper in #862
  - Allow retrieving entryIDs or UUIDs via /api/v1/log/entries/retrieve endpoint by @priyawadhwa in #859
  - Print total tree size, including inactive shards in rekor-cli loginfo by @priyawadhwa in #864
- Updated to rekor 0.7.0
  - remove URL fetch of keys/artifacts server-side by @bobcallaway in #735
  - intoto: add index on materials digest of slsa provenance by @asraa in #793
  - chore(deps): Included dependency review by @naveensrinivasan in #788
  - Check if intoto hash is available before accessing it as an index key by @priyawadhwa in #800
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @asraa in #807
  - Retrieve shard tree length if it isn't provided in the config by @priyawadhwa in #810
  - update release builder images to use go 1.17.10 and cosign image to 1.8.0 by @cpanato in #820
  - update go to 1.17.10 in the dockerfile by @cpanato in #819
  - Limit the number of certificates parsed in a chain by @haydentherapper in #823
  - Breaking change: Remove timestamping authority by @haydentherapper in #813
  - Add back owners for rfc3161 package type by @haydentherapper in #833
  - all: remove dependency on deprecated github.com/pkg/errors by @zchee in #834
  - name stored attestations by digest instead of UUID by @bobcallaway in #769</changelog>
  <changelog author="meissner@suse.com" date="1656504000">- rekor-zypper-verify.sh: add a small script that verifies the on-system
  zypper repo cache against rekor transparency log.</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to rekor 0.9.1
  - feat: add subject URIs to index for x509 certificates by @asraa in #897
  - fix: sql syntax in dbcreate script by @xens in #903
  - Switch to go 1.18 and pin release-utils to v0.7.1 by @saschagrunert in #904
  - Check inactive shards for UUID for /retrieve endpoint by @priyawadhwa in #905
  - ensure log messages have requestID where possible by @bobcallaway in #907
  - Remove unnecessary lookup of non-existent attestations from storage layer by @bobcallaway in #909
  - Fix bug where /retrieve endpoint returns wrong logIndex across shards by @priyawadhwa in #908
- updated to rekor 0.9.0
  - Add COSE support to Rekor by @kommendorkapten in #867
  - Fix intoto index keys by @bobcallaway in #889
  - Resolve virtual log index when calling /retrieve endpoint by @priyawadhwa in #894
- updated to rekor 0.8.2
  - collect docker-compose logs if sharding tests fail, also trim IDs by @bobcallaway in #869
  - ensure fallback logic executes if attestation key is empty when fetching attestation by @bobcallaway in #878</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to rekor 0.12.0 (jsc#SLE-23476):
  - check supportedVersions list rather than directly reading from version map by @bobcallaway in #1003
  - enable blocking specific pluggable type versions from being inserted into the log by @bobcallaway in #1004
  - api.SearchLogQueryHandler thread safety by @cdris in #1006
  - 'docker compose' to 'docker-compose' by @bobcallaway in #1009
  - Intoto v0.0.2 by @pxp928 in #973
  - Add bounds on number of elements in api/v1/log/entries/retrieve by @priyawadhwa in #1011
  - Change Checkpoint origin to be "Hostname - Tree ID" by @haydentherapper in #1013
  - feat: add verification functions by @asraa in #986
  - Validate tree ID on calls to /api/v1/log/entries/retrieve by @priyawadhwa in #1017
  - Include checkpoint (STH) in entry upload and retrieve responses by @haydentherapper in #1015
  - fix: use entry uuid uniformly in return responses by @asraa in #1012
  - remove /api/v1/version endpoint by @bobcallaway in #1022
  - Fix rekor-cli backwards incompatibility &amp; run harness tests against HEAD by @priyawadhwa in #1030
  - Fix harness tests @ main by @priyawadhwa in #1038
  - Fetch all tags in harness tests by @priyawadhwa in #1039
  - fix retrieve endpoint response code and add testing by @asraa in #1043
- updated to rekor 0.11.0:
  - Add rekor harness tests by @priyawadhwa in #945
  - Persist and check attestations across harness tests by @priyawadhwa in #952
  - Add harness test for getting all entries by UUID and EntryID by @priyawadhwa in #957
  - api: fix inclusion proof verification flake by @asraa in #956
  - change default value for rekor_server.hostname to server's hostname by @bobcallaway in #963
  - fix nil-pointer error when artifact-hash is passed without artifact by @dsa0x in #965
  - Add prometheus summary to track metric latency by @priyawadhwa in #966
  - compute payload and envelope hashes upon validating intoto proposed entries by @bobcallaway in #967
  - update field documentation on publicKey for hashedrekord by @bobcallaway in #969
  - Allow sharding config to be written in yaml or json by @priyawadhwa in #974
  - fix incorrect schema id for cose type by @bobcallaway in #979
  - fix: make rekor verify work with sharded uuids by @asraa in #970
  - update builder and cosign images by @cpanato in #981
  - remove trailing slash on directories by @bobcallaway in #984
  - add support for intersection &amp; union in search operations by @dsa0x in #968
  - Update scorecard-action to v2:alpha by @azeemshaikh38 in #987
- updated to rekor 0.10.0:
  - reuse DSSE signature wrappers instead of a local copy by @bobcallaway in #912
  - Updates on the release job/makefile cleanup by @cpanato in #914
  - Return 404 if entry isn't found in log by @priyawadhwa in #915
  - Update cosign image in validate-release job by @priyawadhwa in #931
  - update go builder and cosign image by @cpanato in #934
  - Drop application/yaml content type by @haydentherapper in #933
  - Add rekor test harness to presubmit tests by @priyawadhwa in #921
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #941
  - update go mod in hack/tools to go1.18 by @cpanato in #935
  - add ldflags back by @cpanato in #944</changelog>
  <changelog author="meissner@suse.com" date="1664280000">- updated to rekor 0.12.1 (jsc#SLE-23476):
  - ** Rekor ** v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version
    The addition of the intotov2 created a breaking change for the rekor-cli
  - What's Changed
  - fix: fix harness tests with intoto v0.0.2 by @asraa in #1052
  - feat: add file based signer and password by @asraa in #1049
  - Adds new rekor metrics for latency and QPS. by @var-sdk in #1059</changelog>
  <changelog author="meissner@suse.com" date="1664539200">- updated to rekor 0.12.2 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint
  - Adding e2e test coverage
  - export rekor build/version information
  - Use POST instead of GET for /api/log/entries/retrieve metrics.
  - Search through all shards when searching by hash</changelog>
  <changelog author="meissner@suse.com" date="1666180800">- updated to rekor 1.0.0 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint by @bobcallaway in https://github.com/sigstore/rekor/pull/1073
  - Adding e2e test coverage by @cdris in https://github.com/sigstore/rekor/pull/1071
  - export rekor build/version information by @cpanato in https://github.com/sigstore/rekor/pull/1074
  - Use POST instead of GET for /api/log/entries/retrieve metrics. by @var-sdk in https://github.com/sigstore/rekor/pull/1083
  - Search through all shards when searching by hash by @priyawadhwa in https://github.com/sigstore/rekor/pull/1082
  - verify: verify checkpoint's STH against the inclusion proof root hash by @asraa in https://github.com/sigstore/rekor/pull/1092
  - add ability to enable/disable specific rekor API endpoints by @bobcallaway in https://github.com/sigstore/rekor/pull/1080
  - enable configurable client retries with backoff in RekorClient by @bobcallaway in https://github.com/sigstore/rekor/pull/1096
  - remove dead code around api-key and timestamp references by @bobcallaway in https://github.com/sigstore/rekor/pull/1098
  - update swagger API version to 1.0.0 by @bobcallaway in https://github.com/sigstore/rekor/pull/1102
  - remove unused RekorVersion API definition by @bobcallaway in https://github.com/sigstore/rekor/pull/1101
  - install gocovmerge in hack/tools by @bobcallaway in https://github.com/sigstore/rekor/pull/1103
  - add retry command line flag on rekor-cli by @bobcallaway in https://github.com/sigstore/rekor/pull/1097
  - Add some info and debug logging to commonly used funcs by @priyawadhwa in https://github.com/sigstore/rekor/pull/1106</changelog>
  <changelog author="meissner@suse.com" date="1669723200">- updated to rekor 1.0.1 (jsc#SLE-23476):
  - stop inserting envelope hash for intoto:0.0.2 types into index</changelog>
  <changelog author="meissner@suse.com" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="meissner@suse.com" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="meissner@suse.com" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
</package>
<package pkgid="dce7a4888cc43568d0d7f2039b283f420639d90d6ff066a74fe643f5846bd45a" name="rekor" arch="x86_64">
  <version epoch="0" ver="1.2.1" rel="150400.4.12.1"/>
  <changelog author="mrueckert@suse.de" date="1637928000">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1638964800">- prepare building of the serve part</changelog>
  <changelog author="meissner@suse.com" date="1641470400">- updated to 0.4.0
  Highlights
  - Adds hashed rekord type that can be used to upload signatures along with the hashed content signed (#501)</changelog>
  <changelog author="bwiedemann@suse.com" date="1643112000">- Fix BUILD_DATE for reproducible build results (boo#1047218)</changelog>
  <changelog author="meissner@suse.com" date="1643889600">- enable server build too, as people might want to deploy rekor chain
  themselves.</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- Updated to rekor 0.5.0
  * Highlights
  - Add Rekor logo to README (#650)
  - update API calls to v5 (#591)
  - Refactor helm type to remove intermediate state. (#575)
  - Refactor the shard map parsing so we can pass it down into the API object. (#564)
  - Refactor the alpine type to reduce intermediate state. (#573)
  * Enhancements
  - Add logic to GET artifacts via old or new UUID (#587)
  - helpful error message for hashedrekord types (#605)
  - Set Accept header in dynamic counter requests (#594)
  - Add sharding package and update validators (#583)
  - rekor-cli: show the url in case of error (#581)
  - Enable parsing of incomplete minisign keys, to enable re-indexing. (#567)
  - Cleanups on the TUF pluggable type. (#563)
  - Refactor the RPM type to remove more intermediate state. (#566)
  - Do some cleanups of the jar type to remove intermediate state. (#561)
  * Others
  - update version comments since dependabot doesn't do it (#617)
  - Use workload identity provider instead of GitHub Secret for GCR access (#600)
  - add OSSF scorecard action (#599)
  - enable the sbom for rekor releases (#586)
  - Point to the official website (instead of a 404) (#580)
  - Add a Makefile target for the "ko apply" step. (#572)
  - types/README.md: Corrected documentation link (#568)</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- Updated to rekor 0.6.0
  - attempting to fix codeowners file by @bobcallaway in #653
  - Update the warning text for the GA release. by @dlorenc in #654
  - Add docs about API stability and deprecation policy by @priyawadhwa in #661
  - update cross-build and dockerfile to use go 1.17.7 by @cpanato in #666
  - Move k8s objects out of the default namespace by @k4leung4 in #674
  - add securityContext to deployment. by @k4leung4 in #678
  - Add intoto type documentation by @jspeed-meyers in #679
  - create namespace for rekor config in yaml. by @k4leung4 in #680
  - Set rekor-cli User-Agent header on requests by @bobcallaway in #684
  - update security process link by @bobcallaway in #685
  - explicitly set permissions for github actions by @k4leung4 in #687
  - Add documentation about Alpine type by @jspeed-meyers in #697
  - Add code coverage to pull requests. by @k4leung4 in #676
  - Consistent parenthesis use in Makefile by @k4leung4 in #700
  - Use logRangesFlag in API, route reads based on TreeID by @lkatalin in #671
  - Generate release yaml for non-CI builds. by @k4leung4 in #702
  - Mirror signed release images from GCR to GHCR as part of release by @k4leung4 in #701
  - build trillian container to existing release. by @k4leung4 in #715
  - Make the loginfo command a bit more future/backwards proof. by @dlorenc in #718
  - Switch to using the swag library for pointer manipulation. by @dlorenc in #719
  - Change TreeID to be of type string instead of int64 by @priyawadhwa in #712
  - Add sharding e2e test to Github Actions by @priyawadhwa in #714
  - fix merge conflict by @priyawadhwa in #720
  - Clearer logging for createAndInitTree by @priyawadhwa in #724
  - Return virtual index when creating and getting a log entry by @priyawadhwa in #725
  - Fix copy/paste mistake in repo name. by @k4leung4 in #730
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #729
  - Get log proofs by Tree ID by @priyawadhwa in #733
  - Refactor rekor-cli loginfo by @priyawadhwa in #734
  - Update loginfo API endpoint to return information about inactive shards by @priyawadhwa in #738
  - Replace trillian_log_server.log_id_ranges flag with a config file by @priyawadhwa in #742
  - fix build date format for version command by @cpanato in #745
  - Require tlog_id when log_id_ranges is passed in by @lkatalin in #739
  - Use active tree on server startup by @lkatalin in #727
  - Specify public key for inactive shards in shard config by @priyawadhwa in #746
  - Add support for providing certificate chain for X509 signature types by @haydentherapper in #747
  - fix typo in filename by @bobcallaway in #758
  - Update release jobs and trillian images by @cpanato in #756
  - Add the SHA256 digest of the intoto payload into the rekor entry by @bobcallaway in #764
  - Add index to hashed intoto envelope by @asraa in #761
  - Fix link in types README by @eddiezane in #765
  - set p.Block after parsing in helm provenance type by @bobcallaway in #759
  - Fix search without sha prefix by @eddiezane in #767
  - Add in configmap to release for sharding config by @priyawadhwa in #766
  - Search inactive trees for GET by UUID requests by @lkatalin in #750
  - Create EntryID for new artifacts and return EntryID to user by @lkatalin in #623
  - Update cloudbuild to not fail when copy the images by @cpanato in #773</changelog>
  <changelog author="meissner@suse.com" date="1655726400">- Updated to rekor 0.8.1
  - Fix indexing bug for intoto attestations by @priyawadhwa in #870
  - Allow an expired certificate chain to be uploaded and verified by @haydentherapper in #873
- Updated to rekor 0.8.0
  - Update go-tuf and sigstore/sigstore to non-vulnerable go-tuf version. by @dhaus67 in #847
  - Configure rekor server in e2e tests via env variable by @priyawadhwa in #850
  - update cross-builder image to use go1.17.11 and dockerfile base image by @cpanato in #860
  - update go.mod to go1.17 by @cpanato in #861
  - Improve error message when using ED25519 with HashedRekord type by @haydentherapper in #862
  - Allow retrieving entryIDs or UUIDs via /api/v1/log/entries/retrieve endpoint by @priyawadhwa in #859
  - Print total tree size, including inactive shards in rekor-cli loginfo by @priyawadhwa in #864
- Updated to rekor 0.7.0
  - remove URL fetch of keys/artifacts server-side by @bobcallaway in #735
  - intoto: add index on materials digest of slsa provenance by @asraa in #793
  - chore(deps): Included dependency review by @naveensrinivasan in #788
  - Check if intoto hash is available before accessing it as an index key by @priyawadhwa in #800
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @asraa in #807
  - Retrieve shard tree length if it isn't provided in the config by @priyawadhwa in #810
  - update release builder images to use go 1.17.10 and cosign image to 1.8.0 by @cpanato in #820
  - update go to 1.17.10 in the dockerfile by @cpanato in #819
  - Limit the number of certificates parsed in a chain by @haydentherapper in #823
  - Breaking change: Remove timestamping authority by @haydentherapper in #813
  - Add back owners for rfc3161 package type by @haydentherapper in #833
  - all: remove dependency on deprecated github.com/pkg/errors by @zchee in #834
  - name stored attestations by digest instead of UUID by @bobcallaway in #769</changelog>
  <changelog author="meissner@suse.com" date="1656504000">- rekor-zypper-verify.sh: add a small script that verifies the on-system
  zypper repo cache against rekor transparency log.</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to rekor 0.9.1
  - feat: add subject URIs to index for x509 certificates by @asraa in #897
  - fix: sql syntax in dbcreate script by @xens in #903
  - Switch to go 1.18 and pin release-utils to v0.7.1 by @saschagrunert in #904
  - Check inactive shards for UUID for /retrieve endpoint by @priyawadhwa in #905
  - ensure log messages have requestID where possible by @bobcallaway in #907
  - Remove unnecessary lookup of non-existent attestations from storage layer by @bobcallaway in #909
  - Fix bug where /retrieve endpoint returns wrong logIndex across shards by @priyawadhwa in #908
- updated to rekor 0.9.0
  - Add COSE support to Rekor by @kommendorkapten in #867
  - Fix intoto index keys by @bobcallaway in #889
  - Resolve virtual log index when calling /retrieve endpoint by @priyawadhwa in #894
- updated to rekor 0.8.2
  - collect docker-compose logs if sharding tests fail, also trim IDs by @bobcallaway in #869
  - ensure fallback logic executes if attestation key is empty when fetching attestation by @bobcallaway in #878</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to rekor 0.12.0 (jsc#SLE-23476):
  - check supportedVersions list rather than directly reading from version map by @bobcallaway in #1003
  - enable blocking specific pluggable type versions from being inserted into the log by @bobcallaway in #1004
  - api.SearchLogQueryHandler thread safety by @cdris in #1006
  - 'docker compose' to 'docker-compose' by @bobcallaway in #1009
  - Intoto v0.0.2 by @pxp928 in #973
  - Add bounds on number of elements in api/v1/log/entries/retrieve by @priyawadhwa in #1011
  - Change Checkpoint origin to be "Hostname - Tree ID" by @haydentherapper in #1013
  - feat: add verification functions by @asraa in #986
  - Validate tree ID on calls to /api/v1/log/entries/retrieve by @priyawadhwa in #1017
  - Include checkpoint (STH) in entry upload and retrieve responses by @haydentherapper in #1015
  - fix: use entry uuid uniformly in return responses by @asraa in #1012
  - remove /api/v1/version endpoint by @bobcallaway in #1022
  - Fix rekor-cli backwards incompatibility &amp; run harness tests against HEAD by @priyawadhwa in #1030
  - Fix harness tests @ main by @priyawadhwa in #1038
  - Fetch all tags in harness tests by @priyawadhwa in #1039
  - fix retrieve endpoint response code and add testing by @asraa in #1043
- updated to rekor 0.11.0:
  - Add rekor harness tests by @priyawadhwa in #945
  - Persist and check attestations across harness tests by @priyawadhwa in #952
  - Add harness test for getting all entries by UUID and EntryID by @priyawadhwa in #957
  - api: fix inclusion proof verification flake by @asraa in #956
  - change default value for rekor_server.hostname to server's hostname by @bobcallaway in #963
  - fix nil-pointer error when artifact-hash is passed without artifact by @dsa0x in #965
  - Add prometheus summary to track metric latency by @priyawadhwa in #966
  - compute payload and envelope hashes upon validating intoto proposed entries by @bobcallaway in #967
  - update field documentation on publicKey for hashedrekord by @bobcallaway in #969
  - Allow sharding config to be written in yaml or json by @priyawadhwa in #974
  - fix incorrect schema id for cose type by @bobcallaway in #979
  - fix: make rekor verify work with sharded uuids by @asraa in #970
  - update builder and cosign images by @cpanato in #981
  - remove trailing slash on directories by @bobcallaway in #984
  - add support for intersection &amp; union in search operations by @dsa0x in #968
  - Update scorecard-action to v2:alpha by @azeemshaikh38 in #987
- updated to rekor 0.10.0:
  - reuse DSSE signature wrappers instead of a local copy by @bobcallaway in #912
  - Updates on the release job/makefile cleanup by @cpanato in #914
  - Return 404 if entry isn't found in log by @priyawadhwa in #915
  - Update cosign image in validate-release job by @priyawadhwa in #931
  - update go builder and cosign image by @cpanato in #934
  - Drop application/yaml content type by @haydentherapper in #933
  - Add rekor test harness to presubmit tests by @priyawadhwa in #921
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #941
  - update go mod in hack/tools to go1.18 by @cpanato in #935
  - add ldflags back by @cpanato in #944</changelog>
  <changelog author="meissner@suse.com" date="1664280000">- updated to rekor 0.12.1 (jsc#SLE-23476):
  - ** Rekor ** v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version
    The addition of the intotov2 created a breaking change for the rekor-cli
  - What's Changed
  - fix: fix harness tests with intoto v0.0.2 by @asraa in #1052
  - feat: add file based signer and password by @asraa in #1049
  - Adds new rekor metrics for latency and QPS. by @var-sdk in #1059</changelog>
  <changelog author="meissner@suse.com" date="1664539200">- updated to rekor 0.12.2 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint
  - Adding e2e test coverage
  - export rekor build/version information
  - Use POST instead of GET for /api/log/entries/retrieve metrics.
  - Search through all shards when searching by hash</changelog>
  <changelog author="meissner@suse.com" date="1666180800">- updated to rekor 1.0.0 (jsc#SLE-23476):
  - add description on /api/v1/index/retrieve endpoint by @bobcallaway in https://github.com/sigstore/rekor/pull/1073
  - Adding e2e test coverage by @cdris in https://github.com/sigstore/rekor/pull/1071
  - export rekor build/version information by @cpanato in https://github.com/sigstore/rekor/pull/1074
  - Use POST instead of GET for /api/log/entries/retrieve metrics. by @var-sdk in https://github.com/sigstore/rekor/pull/1083
  - Search through all shards when searching by hash by @priyawadhwa in https://github.com/sigstore/rekor/pull/1082
  - verify: verify checkpoint's STH against the inclusion proof root hash by @asraa in https://github.com/sigstore/rekor/pull/1092
  - add ability to enable/disable specific rekor API endpoints by @bobcallaway in https://github.com/sigstore/rekor/pull/1080
  - enable configurable client retries with backoff in RekorClient by @bobcallaway in https://github.com/sigstore/rekor/pull/1096
  - remove dead code around api-key and timestamp references by @bobcallaway in https://github.com/sigstore/rekor/pull/1098
  - update swagger API version to 1.0.0 by @bobcallaway in https://github.com/sigstore/rekor/pull/1102
  - remove unused RekorVersion API definition by @bobcallaway in https://github.com/sigstore/rekor/pull/1101
  - install gocovmerge in hack/tools by @bobcallaway in https://github.com/sigstore/rekor/pull/1103
  - add retry command line flag on rekor-cli by @bobcallaway in https://github.com/sigstore/rekor/pull/1097
  - Add some info and debug logging to commonly used funcs by @priyawadhwa in https://github.com/sigstore/rekor/pull/1106</changelog>
  <changelog author="meissner@suse.com" date="1669723200">- updated to rekor 1.0.1 (jsc#SLE-23476):
  - stop inserting envelope hash for intoto:0.0.2 types into index</changelog>
  <changelog author="meissner@suse.com" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="meissner@suse.com" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="meissner@suse.com" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
</package>
<package pkgid="0852a039526a5f4f04c82f95876634e3af0e75c2b7caeaf907f2f6451dd0482a" name="ruby-solv" arch="aarch64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="8dd1aa5bb239d52f5748afca27afbb544bc4e1c398032af6bd45f2944e29009f" name="ruby-solv" arch="ppc64le">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="51711b114ef9503dae7121fcb3e5cc331c0bb1023f15edb7624b6777f7d46ca5" name="ruby-solv" arch="s390x">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="44e4f355ed8a0ad7862e730dc2dfbcb3a8d33dd7dc323c3cb1eaede53320fb41" name="ruby-solv" arch="x86_64">
  <version epoch="0" ver="0.7.24" rel="150400.3.6.4"/>
  <changelog author="mls@suse.de" date="1575979200">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
  <changelog author="mls@suse.de" date="1681387200">- handle learnt rules in solver_alternativeinfo()
- support x86_64_v[234] architecture levels
- implement decision sorting for package decisionlists
- add back findutils requires for the libsolv-tools packagse
  [bsc#1195633]
- bump version to 0.7.24</changelog>
</package>
<package pkgid="a5baade9dc5abaa2c4d53212c60c93cae4822265cff77d6e3bcba5dd17caa510" name="snmp-mibs" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="22a2873312e84f4ce13e2bb7046c9bd94d3d8324d2fc11e9141b7dbee7fdc0a0" name="snmp-mibs" arch="ppc64le">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="8895603df278b16148d4be912dab9c322884120e44d44aa353b7cff207cd77a2" name="snmp-mibs" arch="s390x">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="cee8fc82e2129ce9e6b898f28464f7d30db1eaa54832d825afbcdaead7f5742f" name="snmp-mibs" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="8c04d2eab94eb3007b8745e80b8d6f8eb40e13467da330843847c727355f6297" name="supportutils" arch="noarch">
  <version epoch="0" ver="3.1.21" rel="150300.7.35.18.1"/>
  <changelog author="jason.record@suse.com" date="1618488000">- Additions to version 3.1.15
  + Added drbd-overview to drbd.txt
  + Added list-timers to systemd.txt (bsc#1169348)
  + Including nfs4 in search (bsc#1184829)
- Minor: Fix a typo (executible -&gt; executable) #99
- Changed minor wording to loaded module</changelog>
  <changelog author="jason.record@suse.com" date="1618833600">- Additions to version 3.1.15
  + Checks package signatures in rpm.txt (bsc#1021918)
  + Optimize find (bsc#1184912)
- Using zypper --xmlout (bsc#1181351)
- Error fix for sysfs.txt (bsc#1089870)</changelog>
  <changelog author="jason.record@suse.com" date="1620820800">- getappcore checks for valid compression binary (bsc#1185991)
- getappcore does not trigger errors with help message (bsc#1185993)</changelog>
  <changelog author="jason.record@suse.com" date="1621857600">- analyzevmcore supports local directories (bsc#1186397)</changelog>
  <changelog author="jason.record@suse.com" date="1622116800">- Fixes to supportconfig
  + Exclude rhn.conf from etc.txt (bsc#1186347)</changelog>
  <changelog author="jason.record@suse.com" date="1623067200">- Changes to version 3.1.16
  + lsof options to improve performance (bsc#1186687)</changelog>
  <changelog author="jason.record@suse.com" date="1625572800">- Changes to version 3.1.17
  + Adding ethtool options g l m to network.txt (jsc#SLE-18240)</changelog>
  <changelog author="jason.record@suse.com" date="1629115200">- Changes to version 3.1.18
  + Added email.txt based on OPTION_EMAIL #108 (bsc#1189028)
  + Include 'multipath -t' output in mpio.txt #105
  + Improved lsblk readability with --ascsi #106
  + Removed duplicate commands in network.txt
  + Remove duplicate firewalld status output #109</changelog>
  <changelog author="jason.record@suse.com" date="1631102400">- Fixed cron package for RPM validation (bsc#1190315)
- Updated spec file with correct URL</changelog>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
  <changelog author="jason.record@suse.com" date="1668168000">- Changes to supportconfig version 3.1.11-46.3
  + Added missed sanitation check on crash.txt (bsc#1203818)
- Changes to supportconfig.rc version 3.1.11-30
  + Added check to _sanitize_file
  + Using variable for replement text in _sanitize_file</changelog>
</package>
<package pkgid="0855546c2aa0bdbbbc9f78afd23ab2a0d82c439f9d912b65acf18698f7afa8a1" name="supportutils" arch="src">
  <version epoch="0" ver="3.1.21" rel="150300.7.35.18.1"/>
  <changelog author="jason.record@suse.com" date="1618488000">- Additions to version 3.1.15
  + Added drbd-overview to drbd.txt
  + Added list-timers to systemd.txt (bsc#1169348)
  + Including nfs4 in search (bsc#1184829)
- Minor: Fix a typo (executible -&gt; executable) #99
- Changed minor wording to loaded module</changelog>
  <changelog author="jason.record@suse.com" date="1618833600">- Additions to version 3.1.15
  + Checks package signatures in rpm.txt (bsc#1021918)
  + Optimize find (bsc#1184912)
- Using zypper --xmlout (bsc#1181351)
- Error fix for sysfs.txt (bsc#1089870)</changelog>
  <changelog author="jason.record@suse.com" date="1620820800">- getappcore checks for valid compression binary (bsc#1185991)
- getappcore does not trigger errors with help message (bsc#1185993)</changelog>
  <changelog author="jason.record@suse.com" date="1621857600">- analyzevmcore supports local directories (bsc#1186397)</changelog>
  <changelog author="jason.record@suse.com" date="1622116800">- Fixes to supportconfig
  + Exclude rhn.conf from etc.txt (bsc#1186347)</changelog>
  <changelog author="jason.record@suse.com" date="1623067200">- Changes to version 3.1.16
  + lsof options to improve performance (bsc#1186687)</changelog>
  <changelog author="jason.record@suse.com" date="1625572800">- Changes to version 3.1.17
  + Adding ethtool options g l m to network.txt (jsc#SLE-18240)</changelog>
  <changelog author="jason.record@suse.com" date="1629115200">- Changes to version 3.1.18
  + Added email.txt based on OPTION_EMAIL #108 (bsc#1189028)
  + Include 'multipath -t' output in mpio.txt #105
  + Improved lsblk readability with --ascsi #106
  + Removed duplicate commands in network.txt
  + Remove duplicate firewalld status output #109</changelog>
  <changelog author="jason.record@suse.com" date="1631102400">- Fixed cron package for RPM validation (bsc#1190315)
- Updated spec file with correct URL</changelog>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
  <changelog author="jason.record@suse.com" date="1668168000">- Changes to supportconfig version 3.1.11-46.3
  + Added missed sanitation check on crash.txt (bsc#1203818)
- Changes to supportconfig.rc version 3.1.11-30
  + Added check to _sanitize_file
  + Using variable for replement text in _sanitize_file</changelog>
</package>
<package pkgid="b973c9e6232bb25e56e0236e9a78956815bbfc506946787da80eea5422b33ff8" name="supportutils-plugin-suse-public-cloud" arch="noarch">
  <version epoch="0" ver="1.0.7" rel="150000.3.14.1"/>
  <changelog author="rjschwei@suse.com" date="1454587200">- Initial build
  + Version 1.0.0</changelog>
  <changelog author="rjschwei@suse.com" date="1454587201">- Include in SLE 12 (FATE#320442, bsc#963690)
- Include in SLE 11 (FATE#320441, bsc#963688)</changelog>
  <changelog author="rjschwei@suse.com" date="1470052800">- Update to verion 1.0.1 (bsc#990887, bsc#990888)
  + Include information about instance initialization generated by
    the initialization code in the log</changelog>
  <changelog author="rjschwei@suse.com" date="1503489600">- Update to version 1.0.2 (bsc#1053737, bsc#1053738)
  + Add additional package to the framework specific package queries</changelog>
  <changelog author="jgleissner@suse.com" date="1596196800">- Update to version 1.0.3 (bsc#1174618, bsc#1170475, bsc#1170476)
  + Drop rc file name extension from rpm lists
  + Sanatize data
  + Use updated azuremetadata
  + Add /etc/os-release data
  + Check update infrastructure is reachable</changelog>
  <changelog author="jgleissner@suse.com" date="1596283200">- Update to version 1.0.4
  + Fix output redirection in registration info query</changelog>
  <changelog author="rjschwei@suse.com" date="1597406400">- Update to version 1.0.5 (bsc#1175250, bsc#1175251)
  + Query for new GCE initialization code packages</changelog>
  <changelog author="rjschwei@suse.com" date="1643112000">- Update to version 1.0.6 (bsc#1195095, bsc#1195096)
  + Include cloud-init logs whenever they are present
  + Update the packages we track in AWS, Azure, and Google
  + Include the ecs logs for AWS ECS instances</changelog>
  <changelog author="rjschwei@suse.com" date="1681819200">- Update to version 1.0.7 (bsc#1209026)
  + Include information about the cached registration data
  + Collect the data that is sent to the update infrastructure during
    registration</changelog>
</package>
<package pkgid="869e61d5827a871e97b2128435b058be2efe04ef9770fea0072b26dbd7d72768" name="supportutils-plugin-suse-public-cloud" arch="src">
  <version epoch="0" ver="1.0.7" rel="150000.3.14.1"/>
  <changelog author="rjschwei@suse.com" date="1454587200">- Initial build
  + Version 1.0.0</changelog>
  <changelog author="rjschwei@suse.com" date="1454587201">- Include in SLE 12 (FATE#320442, bsc#963690)
- Include in SLE 11 (FATE#320441, bsc#963688)</changelog>
  <changelog author="rjschwei@suse.com" date="1470052800">- Update to verion 1.0.1 (bsc#990887, bsc#990888)
  + Include information about instance initialization generated by
    the initialization code in the log</changelog>
  <changelog author="rjschwei@suse.com" date="1503489600">- Update to version 1.0.2 (bsc#1053737, bsc#1053738)
  + Add additional package to the framework specific package queries</changelog>
  <changelog author="jgleissner@suse.com" date="1596196800">- Update to version 1.0.3 (bsc#1174618, bsc#1170475, bsc#1170476)
  + Drop rc file name extension from rpm lists
  + Sanatize data
  + Use updated azuremetadata
  + Add /etc/os-release data
  + Check update infrastructure is reachable</changelog>
  <changelog author="jgleissner@suse.com" date="1596283200">- Update to version 1.0.4
  + Fix output redirection in registration info query</changelog>
  <changelog author="rjschwei@suse.com" date="1597406400">- Update to version 1.0.5 (bsc#1175250, bsc#1175251)
  + Query for new GCE initialization code packages</changelog>
  <changelog author="rjschwei@suse.com" date="1643112000">- Update to version 1.0.6 (bsc#1195095, bsc#1195096)
  + Include cloud-init logs whenever they are present
  + Update the packages we track in AWS, Azure, and Google
  + Include the ecs logs for AWS ECS instances</changelog>
  <changelog author="rjschwei@suse.com" date="1681819200">- Update to version 1.0.7 (bsc#1209026)
  + Include information about the cached registration data
  + Collect the data that is sent to the update infrastructure during
    registration</changelog>
</package>
<package pkgid="3a68fdf6f5d5287b02de55b74f0fd5eb73444dc8a6deb478b440ac7ac7979522" name="tiff" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="c9a00a61c6c87fd516cae38d4390d4f82e5a063ebb686ed99aa2291ffc64e8d4" name="tiff" arch="ppc64le">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="495a3ac74d19e79d0614461dfe40fe21007689a77023b23084c359d841e2bd3e" name="tiff" arch="s390x">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="dfedf276ba911130a19e139a023317497b2e9c4724ee29f1ef7889e70964b000" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="64b02d4c2c7f119c2c071848c42328a2828523d13c75322d3fa9dce03d2e8c3b" name="tiff" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.28.1"/>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
  <changelog author="mvetter@suse.com" date="1684497600">- security update:
  * CVE-2023-0795 [bsc#1208226]
  * CVE-2023-0796 [bsc#1208227]
  * CVE-2023-0797 [bsc#1208228]
  * CVE-2023-0798 [bsc#1208229]
  * CVE-2023-0799 [bsc#1208230]
    + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch
  * CVE-2023-0800 [bsc#1208231]
  * CVE-2023-0801 [bsc#1208232]
  * CVE-2023-0802 [bsc#1208233]
  * CVE-2023-0803 [bsc#1208234]
  * CVE-2023-0804 [bsc#1208236]
    + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch</changelog>
</package>
<package pkgid="821d5333295a56a0e38a9756b19b0d8e06974b43577866d61e71a57bb0fd02a1" name="tomcat" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="67c4ea425298d03b0cdf39dd54425a18e07149dc5da1d3172272cc78ac4dc62c" name="tomcat" arch="src">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="5aa873ba6f9286d20a2b0f0900835efbffd734601e2cb9fc8d1a3fdca54370fc" name="tomcat-admin-webapps" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="74bf9f13ff9c8ca3831b49680610bef477a2e755b0739150d43af453175e36a7" name="tomcat-docs-webapp" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="3656874f87a843397c1d6403c809218101e74fddd65cdb796c3e31b17cf11612" name="tomcat-el-3_0-api" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="2bd934fcbdb498058dcfdc194b051e36984d539aa4300668b4266f63c5e0df48" name="tomcat-embed" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="404504aa36517001d47e26dd23ea9b781ec68b69ccb959f00055646e54048287" name="tomcat-javadoc" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="ca61b1f87dcaa72abfef55b58f74006f7e876ca0dde6c8d472e280b3de925845" name="tomcat-jsp-2_3-api" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="57e483c7eaefb811661152cfb745a96c53ab687945b79c26a039e9425ff09916" name="tomcat-jsvc" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="f3d4253c157abba7b2cbd2a36f50af82683fa71d9324f290660dc9d6e6fa7935" name="tomcat-lib" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="c8a6cd939a8176de3c87736a1e48aaa9804d3f2e5719785bc8d89fc878cabca9" name="tomcat-servlet-4_0-api" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="2d15235104ed5a8bdf94ad0f9df641627eed065dda9f08942fd3a1c83bc752a4" name="tomcat-webapps" arch="noarch">
  <version epoch="0" ver="9.0.75" rel="150200.41.1"/>
  <changelog author="wittemar@googlemail.com" date="1634558400">- Update to Tomcat 9.0.43. See changelog at
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.43_(markt)
- Removed Patches because fixed upstream now:
  * tomcat-9.0-CVE-2021-25122.patch
  * tomcat-9.0-CVE-2021-25329.patch
- Rebased patch:
  tomcat-9.0.39-java8compat.patch -&gt; tomcat-9.0.43-java8compat.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635422400">- Fixed CVEs:
  * CVE-2021-41079: Validate incoming TLS packet (bsc#1190558)
- Added patches:
  * tomcat-9.0-CVE-2021-41079.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1635508800">- Fixed CVEs:
  * CVE-2021-30640: Escape parameters in JNDI Realm queries (bsc#1188279)
  * CVE-2021-33037: Process T-E header from both HTTP 1.0 and HTTP 1.1. clients (bsc#1188278)
- Added patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch</changelog>
  <changelog author="fstrba@suse.com" date="1636545600">- Modified patch:
  * tomcat-9.0-osgi-build.patch
    + account for biz.aQute.bnd.ant artifact in aqute-bnd &gt;= 5.2.0</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1639137600">- Fix NPE in JNDIRealm, when userRoleAttribute is not set (bsc#1193569)
- Added patch:
  * tomcat-9.0-NPE-JNDIRealm.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1643371200">- Fixed CVEs:
  * CVE-2022-23181: Make calculation of session storage location more robust (bsc#1195255)
- Added patches:
  * tomcat-9.0-CVE-2022-23181.patch</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1645617600">- Remove dependency on log4j/reload4j completely (bsc#1196137)</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1649332800">- Security hardening. Deprecate getResources() and always return null. (bsc#1198136)
- Added patch: tomcat-9.0-hardening_getResources.patch</changelog>
  <changelog author="fstrba@suse.com" date="1657195200">- Fix bsc#1201081 by building with release=8 all files that can be
  built this way. The one file remaining, build it with source=8 and
  target=8
- Modified patch:
  * tomcat-9.0.43-java8compat.patch
    + Do not cast ByteBuffer to Buffer to call the Java 8 compatible
    methods. Build with release=8 instead</changelog>
  <changelog author="fstrba@suse.com" date="1657713600">- Do not hardcode /usr/libexec but use %%_libexecdir during the
  build
  * Fixes for platforms, where /usr/libexec and %%_libexecdir are
    different</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1666267200">- Fixed CVEs:
  * CVE-2021-43980: Improve the recycling of Processor objects to make it more robust. (bsc#1203868)
- Added patches:
  * tomcat-9.0.43-CVE-2021-43980.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669032000">- Fixed CVEs:
  * CVE-2022-42252: reject invalid content-length requests. (bsc#1204918)
- Added patches:
  * tomcat-9.0.43-CVE-2022-42252.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1669723200">- Use catalina.out for logging (bsc#1205647)
- Added patches:
  * tomcat-9.0-fix_catalina.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1671796800">- set logrotate for localhost.log, manager.log, host-manager.log and localhost_access_log.txt
- use logrotate for catalina.out
  * update tomcat-serverxml-tool and spec to configure server.xml
- Added patch:
  * tomcat-9.0-logrotate_everything.patch
  * tomcat-serverxml-tool.tar.gz
- Removed:
  * tomcat-serverxml-tool-1.0.tar.gz</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1677585600">- Fixed CVEs:
  * CVE-2023-24998: tomcat,tomcat6: FileUpload DoS with excessive parts (bsc#1208513)
- Added patches:
  * tomcat-9.0.43-CVE-2023-24998.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1679572800">- Fixed CVEs:
  * CVE-2023-28708: tomcat: not including the secure attribute
    causes information disclosure (bsc#1209622)
- Added patches:
  * tomcat-9.0.43-CVE-2023-28708.patch</changelog>
  <changelog author="michele.bussolotto@suse.com" date="1680868800">- Fixed CVEs:
  * CVE-2022-45143: JsonErrorReportValve: add escape for type, message or description (bsc#1206840)
- Added patches:
  * tomcat-9.0.43-CVE-2022-45143.patch</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Update to Tomcat 9.0.75.
  * See changelog at
    https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.75_(markt)
  * Fixes:
    + bsc#1211608, CVE-2023-28709
    + bsc#1208513, CVE-2023-24998 (previous incomplete fix)
- Remove patches:
  * tomcat-9.0-CVE-2021-30640.patch
  * tomcat-9.0-CVE-2021-33037.patch
  * tomcat-9.0-CVE-2021-41079.patch
  * tomcat-9.0-CVE-2022-23181.patch
  * tomcat-9.0-NPE-JNDIRealm.patch
  * tomcat-9.0-hardening_getResources.patch
  * tomcat-9.0.43-CVE-2021-43980.patch
  * tomcat-9.0.43-CVE-2022-42252.patch
  * tomcat-9.0.43-CVE-2022-45143.patch
  * tomcat-9.0.43-CVE-2023-24998.patch
  * tomcat-9.0.43-CVE-2023-28708.patch
    + integrated in this version
  * tomcat-9.0.43-java8compat.patch
    + problem with Java 8 compatibility solved in this version
- Modified patch:
  * tomcat-9.0.31-secretRequired-default.patch
  - &gt; tomcat-9.0.75-secretRequired-default.patch
    + rediffed to changed context
  * tomcat-9.0-javadoc.patch
    + drop integrated hunks
  * tomcat-9.0-osgi-build.patch
    + fix to work with current version
- Added patch:
  * tomcat-9.0-jdt.patch
    + fix build against our ecj</changelog>
</package>
<package pkgid="dfc52d7078b465fd54f772746088d9ba68b2fbdbbc00a2c8d11de1154d1d7ee8" name="wireshark" arch="aarch64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="d80354a35a7b7751ec2b7ec48892420d5e5239e069b61de1a42bae640303b74b" name="wireshark" arch="ppc64le">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="6c5574d409958fd12459a157cebb954bd4eedf60cc49db06e85fec6231669e5d" name="wireshark" arch="s390x">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="3692c6d0d809bd39855724d259244f9e9da99e6fe8b617fd152f20ae80cbe6b4" name="wireshark" arch="src">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="65f0ad8a343488b23ec672e579b745f1d6d7c442dae1edcd30de2dfbd36ffc0f" name="wireshark" arch="x86_64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="2a99ea4dc0cddf0cd5d1c84d9a01a64b576d49a111ad4e6963f3a5b2b3f1e5ea" name="wireshark-devel" arch="aarch64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="0b445f694c1abc7114a77915ee1621f670717bc5253c9a620f3ac410d8e3c6be" name="wireshark-devel" arch="ppc64le">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="021d66bafb1c6112d8eb5edc2c963625ef69f6ef18db0eaa6ce882a55c252beb" name="wireshark-devel" arch="s390x">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="0a01ed4ff9f30f197aeeb370e7d9a3ebc956c0c645179a48a6a644c56d16a084" name="wireshark-devel" arch="x86_64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="25e044d5908cfe9250272f84c0a463ccb53c3efa3c9e65d9afe27f628863f03a" name="wireshark-ui-qt" arch="aarch64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="c2042ae370d30569ba28e4cb82588b6f8ca061fde5d9b6816992f06bb80ac37e" name="wireshark-ui-qt" arch="ppc64le">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="4bead5a9adf270f876d0a3b41c8fea3a98e19c9db6ab0f8f17942b874a258baf" name="wireshark-ui-qt" arch="s390x">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="f20c662f382dd6452622cd6758dd6338176d6945b3f41c371c64b2171bca60ce" name="wireshark-ui-qt" arch="x86_64">
  <version epoch="0" ver="3.6.14" rel="150000.3.92.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622721600">- Wireshark 3.4.6:
  * Fix DVB-S2-BB dissector infinite loop (boo#1186790, wnpa-sec-2021-04)
  * Fix Macro filters handling of escaped characters
  * Fix Display filter crash
  * Fix IEEE-1588 Signalling Unicast TLV incorrectly reported as being
    malformed
  * Fix IETF QUIC TLS decryption error with extraneous packets during
    the handshake
  * Fix Statistics - Resolved Addresses: multi-protocol (TCP/UDP/...)
    ports not displayed</changelog>
  <changelog author="rfrohl@suse.com" date="1626436800">- Wireshark 3.4.7:
  * CVE-2021-22235: Fix DNP dissector crash (boo#1188375, wnpa-sec-2021-06)
  * Fix TCP dissector - Erroneous DSACK reporting
  * Fix No wlan_radio.duration calculated for PHY type: 802.11ac (VHT)
  * Fix NAN Dissector has wrong minimum length for availability attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1629979200">- Wireshark 3.4.8:
  * Dissector bug reported for Bluetooth Cycling Power Measurement
    characteristic for extreme angles value
  * Raknet Addresses are incorrectly identified.
  * Editcap saving files as ethernet when specifying '-T ieee-802-11-*'
  * CoAP dissector confuses Content-Format with Accept
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1633608000">- Wireshark 3.4.9:
  * TShark PDML output embeds "proto" elements within other "proto" elements.
  * Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work.
  * AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets.
  * IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field.
  * Wireshark ignored some character in filename when exporting SMB objects.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.9.html</changelog>
  <changelog author="info@paolostivanin.com" date="1637236800">- Wireshark 3.4.10 (bsc#1192830):
  * CVE-2021-39929: Bluetooth DHT dissector crash.
  * CVE-2021-39926: Bluetooth HCI_ISO dissector crash.
  * CVE-2021-39925: Bluetooth SDP dissector crash.
  * CVE-2021-39924: Bluetooth DHT dissector large loop.
  * CVE-2021-39922: C12.22 dissector crash.
  * CVE-2021-39928: IEEE 802.11 dissector crash.
  * CVE-2021-39921: Modbus dissector crash.
  * CVE-2021-39920: IPPUSB dissector crash.
  * PNRP dissector large loop.
  * Fix forward compatibility issue with the I/O Graphs preferences.
  * OSS-Fuzz: Heap-use-after-free in ROS.
  * Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match.
  * Dumpcap with threads reports double received count vs captured.
  * HTTP2 dissector reports an assertion error on large data frames.
  * Shark stops capturing when capturing with multiple files and packet printing enabled.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html</changelog>
  <changelog author="rfrohl@suse.com" date="1640001600">- Wireshark 3.6.0:
  * CVE-2021-4186: Gryphon dissector crash (boo#1194165).
  * Several changes have been made to the display filter syntax:
  - The expression "a != b" now always has the same meaning as
    "!(a == b)". In particular this means filter expressions with
    multi-value fields like "ip.addr != 1.1.1.1" will work as
    expected (the result is the same as typing "ip.src != 1.1.1.1 and
    ip.dst != 1.1.1.1"). This avoids the contradiction (a == b and a!= b)
    being true.
  - It is possible to use the syntax "a ~= b" or "a any_ne b" to
    recover the previous (inconsistent with "==") logic for not equal.
  - Literal strings can now be specified using raw string syntax,
    identical to raw strings in the Python programming language. This
    can be used to avoid the complexity of using two levels of
    character escapes with regular expressions.
  - Set elements must now be separated using a comma. A filter
    such as http.request.method in {"GET" "HEAD"} must be written as ...
    in {"GET", "HEAD"}. Whitespace is not significant. The
    previous use of whitespace as separator is deprecated and will be
    removed in a future version.
  - Support for the syntax "a not in b" with the same meaning as
    "not a in b" has been added.
  * TCP conversations now support a completeness criteria, which
    facilitates the identification of TCP streams having any of
    opening or closing handshakes, a payload, in any combination. It
    can be accessed with the new tcp.completeness filter.
  * Protobuf fields that are not serialized on the wire or otherwise
    missing in capture files can now be displayed with default values
    by setting the new "add_default_value" preference. The default
    values might be explicitly declared in "proto2" files, or false
    for bools, first value for enums, zero for numeric types.
  * Wireshark now supports reading Event Tracing for Windows (ETW). A
    new extcap named ETW reader is created that now can open an etl
    file, convert all events in the file to DLT_ETW packets and write
    to a specified FIFO destination. Also, a new packet_etw dissector
    is created to dissect DLT_ETW packets so Wireshark can display
    the DLT_ETW packet header, its message and packet_etw dissector
    calls packet_mbim sub_dissector if its provider matches the MBIM
    provider GUID.
  * "Follow DCCP stream" feature to filter for and extract the contents of DCCP streams.
  * Wireshark now supports dissecting RTP packets with OPUS payloads.
  * Added support for Shared Memory Communications (SMC) (jsc#SLE-18727)
- Further features, bug fixes and new and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html
- updated patch to work with upstream changes
  wireshark-0001-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1640865600">- Wireshark 3.6.1:
  * CVE-2021-4185: RTMPT dissector infinite loop (boo#1194166)
  * CVE-2021-4184: BitTorrent DHT dissector infinite loop (boo#1194167)
  * CVE-2021-4183: pcapng file parser crash (boo#1194168)
  * CVE-2021-4182: RFC 7468 file parser infinite loop (boo#1194169)
  * CVE-2021-4181: Sysdig Event dissector crash (boo#1194170)
  * CVE-2021-4190: Kafka dissector infinite loop (boo#1194171)
  * Add '-o console.log.level:' transitional option for backward-
    compatibilty replacing the 'console.log.level' preference
    removed in 3.6.0. Only avoids cli failures and will be removed
    in the future.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html</changelog>
  <changelog author="rfrohl@suse.com" date="1641816000">- Fix SLE15 build issue
  added wireshark-0000-wsutil-implicit_declaration_memcpy.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1642507200">- Fix wireshark-plugin-libvirt build after wmem_alloc() moved from
  libwireshark.so to libwsutil.so (bsc#1194780)
  * Added wireshark-0001-pkgconfig.patch
- Renamed wireshark-0001-dumpcap-permission-denied.patch
  to  wireshark-0010-dumpcap-permission-denied.patch</changelog>
  <changelog author="rfrohl@suse.com" date="1644580800">- Wireshark 3.6.2:
  * CVE-2022-0586: RTMPT dissector infinite loop (boo#1195866)
  * CVE-2022-0585: Large loops in multiple dissectors (boo#1195867)
  * CVE-2022-0583: PVFS dissector crash (boo#1195868)
  * CVE-2022-0582: CSN.1 dissector crash (boo#1195869)
  * CVE-2022-0581: CMS dissector crash (boo#1195870)
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html</changelog>
  <changelog author="rfrohl@suse.com" date="1648123200">- Wireshark 3.6.3:
  * Fuzz job crash output: fuzz-2021-01-19-7399.pcap.
  * TLS dissector incorrectly reports JA3 values.
  * "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab?.
  * Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message.
  * Bluetooth: Fails to open Log file for SCO connection.
  * Fuzz job crash output: fuzz-2022-03-07-10896.pcap.
  * libwiretap: Save as ERF causes segmentation fault.
  * HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream".
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.3.html</changelog>
  <changelog author="rfrohl@suse.com" date="1651752000">- Wireshark 3.6.5 and 3.6.4:
  * The 3.6.5 release fixes an installation issue on Windows which was introduced in the 3.6.4 release
  * Build failure with GCC 7.5, Linux.
  * RDP dissected as SSL.
  * IPFIX/cflow dissector asserts when varlen field length is zero.
  * 802.11ax HE PHY "Device Class" dissected incorrectly.
  * DHCPv6 Option 15 User-Class incorrectly parsed in Wireshark.
  * ICMPv6 dissector: PREF64 option parsing only works for prefix length 96.
  * Switch macOS updater to Sparkle 2.
  * CQL timestamp dissector displays the wrong timestamp.
  * Unable to dissect 802.11ax Target Wake Time (TWT) packets.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html</changelog>
  <changelog author="rfrohl@suse.com" date="1655726400">- Wireshark 3.6.6:
  * TLS: RSA decryption fails with Extended Master Secret and renegotiation.
  * "dfilter" file on Windows adds carriage returns, and requires line feeds.
  * "Browse" button in Prefs/Name Resolution/MaxMind crashes Wireshark on macOS.
  * TFTP: some packets are not recognized as TFTP packets with 3.6.5.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.6.html</changelog>
  <changelog author="rfrohl@suse.com" date="1659009600">- Wireshark 3.6.7:
  * Multiple Files preference "Create new file automatically… after" [time] working incorrectly.
  * get_filter Lua function doesn’t return the filter.
  * Dissector bug, protocol HTTP failed assertion "saved_layers_len &lt; 500" with chunked/multipart.
  * Wrong EtherCAT bit label (possible dissector bug).
  * UDP packets falsely marked as "malformed packet".
  * TLS certificate parser with filter crash.
  * Incorrect type for the IEC 60870 APDU appears in packet details pane.
  * NHRP Problem.
  * EtherCAT CoE header unknown type.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.7.html</changelog>
  <changelog author="rfrohl@suse.com" date="1662638400">- Wireshark 3.6.8:
  * CVE-2022-3190: F5 Ethernet Trailer dissector infinite loop (boo#1203388).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.8.html</changelog>
  <changelog author="rfrohl@suse.com" date="1670500800">- Wireshark 3.6.10:
  * CVE-2022-4345: Multiple dissector infinite loops (bsc#1206189).
  * Kafka dissector memory exhaustion (bsc#1206190).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.10.html
- Wireshark 3.6.9:
  * CVE-2022-3725: OPUS dissector crash (bsc#1204822).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.9.html</changelog>
  <changelog author="rfrohl@suse.com" date="1674216000">- Wireshark 3.6.11 (bsc#1207447):
  * CVE-2023-0417: NFS dissector memory leak (bsc#1207669).
  * CVE-2023-0413: Dissection engine crash (bsc#1207665).
  * CVE-2023-0416: GNW dissector crash (bsc#1207668).
  * CVE-2023-0415: iSCSI dissector crash (bsc#1207667).
  * CVE-2023-0411: Multiple dissector excessive loops (bsc#1207663).
  * CVE-2023-0412: TIPC dissector crash (bsc#1207664).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.11.html</changelog>
  <changelog author="rfrohl@suse.com" date="1677844800">- Wireshark 3.6.12:
  * CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash (bsc#1208914).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.12.html</changelog>
  <changelog author="rfrohl@suse.com" date="1681387200">- Wireshark 3.6.13:
  * CVE-2023-1992: RPCoRDMA dissector crash (bsc#1210405).
  * CVE-2023-1993: LISP dissector large loop (bsc#1210404).
  * CVE-2023-1994: GQUIC dissector crash (bsc#1210403).
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html</changelog>
  <changelog author="rfrohl@suse.com" date="1685016000">- Wireshark 3.6.14:
  * CVE-2023-2855: Candump log file parser crash (boo#1211703).
  * CVE-2023-2856: VMS TCPIPtrace file parser crash (boo#1211707).
  * CVE-2023-2857: BLF file parser crash (boo#1211705).
  * CVE-2023-2858: NetScaler file parser crash (boo#1211706).
  * CVE-2023-0668: IEEE C37.118 Synchrophasor dissector crash (boo#1211710).
  * GDSDB dissector infinite loop.
  * XRA dissector infinite loop.
- Further features, bug fixes and updated protocol support as listed in:
  https://www.wireshark.org/docs/relnotes/wireshark-3.6.14.html</changelog>
</package>
<package pkgid="3db37cc293e4e7d12d70230d21b376a6d5d013d6488ee1c397cb36d9c77c9f16" name="xmlsec1" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="eef9ff0ab370e56e03d76f326293a00babda1ac071baed9d63958b6c41396868" name="xmlsec1" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="fc5f7bf808157022135bbd58d342f9ce2cbc6da8704fac96ca9ba0c04efb278b" name="xmlsec1" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="546e110204eb9ae2732b7aa955ccfcd3c860e9b2bf1048064348852152097cb3" name="xmlsec1" arch="src">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="mvyskocil@suse.com" date="1389096000">- Initial packaging of xmlsec1 for SUSE</changelog>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="a70b634187342341a9bc19dafd64df017a37458b850f466b48af0192858192fc" name="xmlsec1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="f7f85339530aecd1eac83f6f754d198b883881254fa5ad0f0ddc2ea253e06f88" name="xmlsec1-devel" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="904fd04a8446029225777f0d611ba86c64438cf16e241f20c1d1f8e589278798" name="xmlsec1-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="6f3510a6544964735ff36467c1f3df86e8ff83f869e65b7a1d22297817844947" name="xmlsec1-devel" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="c12e4bc94f9aa4cc53aef2a12d34d5905ac49bdabb1653825a90e01b59612059" name="xmlsec1-devel" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="355d542f8e98f84fe9af116ec7bff9b11b8d7f0f64bf9d81889b6e6a621f9f5b" name="xmlsec1-gcrypt-devel" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="123b6e4fea4151e1a22272d4cc23bb46b9858b873d263f1140dc2fde23da7922" name="xmlsec1-gcrypt-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="ef563b8817557d26ac383b28d52644fec371a569a83dd8272380d08ad2bf297c" name="xmlsec1-gcrypt-devel" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="e647b0e52496bf52efd70b983ad55b7a36398c063b89a3d6bc486d59a61d0e00" name="xmlsec1-gcrypt-devel" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="e96ecb1931eda65f170994214866de5a1d6f20be13fa773627b954c8d8828857" name="xmlsec1-gnutls-devel" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="3372804343106e858057298c29d84e05180b70a7d5fe0c4c82f0eca205017d46" name="xmlsec1-gnutls-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="36aa5503b172672f76339d4c1ccf62b404a018db195f0b86688c6cfcd40f573e" name="xmlsec1-gnutls-devel" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="524083e02c676638909cf664698063d0f1de6969e67c0f31a229c0f3e355c366" name="xmlsec1-gnutls-devel" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="b01d9876bd1ce3ac517bd2f35fb52283f053975c63562a53228d7e64b61d0a92" name="xmlsec1-nss-devel" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="484092025e8fb9a3f8fa985e049b9b2ef2f115628078cd4b7ea9fc3ffa9ff3ec" name="xmlsec1-nss-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="bbb9e74795adbe8ea86bc7f4c7c6665c2759d9d4587ee36d33e0bb4bd9e98bc1" name="xmlsec1-nss-devel" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="b1b543b801c899cacb9c56912d4b836213bc851c013bdfcbe336c1b12253b0a3" name="xmlsec1-nss-devel" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="3563788624ff94f3de729a2d3905240b114c27caee9b4c2c93e718354fd4e071" name="xmlsec1-openssl-devel" arch="aarch64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="0223e14c84508a91f18bccae7744fbd3999e1e82a140c1223a91b16a3eac5182" name="xmlsec1-openssl-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="28155db440d8b5da68c1f354c182d1674097df89baf5272b4677ee5ef1e9798d" name="xmlsec1-openssl-devel" arch="s390x">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="ee90ca003db924486471001d954979917033586c3485b3c4f547ab275044a404" name="xmlsec1-openssl-devel" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.13.4"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="d4515174a4cf69c1476b61c09214e15afbaec97aa50bdc36ac28ba6f427bc9ef" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
<package pkgid="dab16720a73fb8ce2b12798f0426efb782061c8371e079588d9657bc5c42514b" name="zypper" arch="ppc64le">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
<package pkgid="6b80df7345d2ab08f8d2300a3efa0b6413ef7e1ab786ac3ef28a4e3e09f15e9a" name="zypper" arch="s390x">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
<package pkgid="d3c736ac6009e9c9deae36a66366cb9a503e542bffd989f54990fcf2b378ebc2" name="zypper" arch="src">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
<package pkgid="142802545fdc23208712ff0fa9eaac7e58df40f3d53ef5c941ccbc22bede09cd" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
<package pkgid="6db2343a69e241ccefd6503fe865a10977c1a3c0a13b5d98def60619930c45fe" name="zypper-aptitude" arch="noarch">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
<package pkgid="f9eafa98b8ae45bdc52b4bcd86fc85a3ac77bad5e73c5477f9fa12d8fd2e8762" name="zypper-log" arch="noarch">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
<package pkgid="467a1c18e4dcb9690d957a1729a68e3c5da3a546621f4e4afeba4235137b11a7" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.60" rel="150400.3.21.2"/>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
  <changelog author="ma@suse.de" date="1680264000">- Fix selecting installed patterns from picklist (bsc#1209406)
- man: better explanation of --priority (fixes #480)
- version 1.14.60</changelog>
</package>
</otherdata>